aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
CloudFormation marks duplicate AWS::Cognito::UserPoolIdentityProvider as CREATE_COMPLETE and does not report the error from failed CreateIdentityProvider
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::Cognito::UserPoolIdentityProvider
### Resource Name
_No response_
### Issue Description
If you try to create a **AWS::Cognito::UserPoolIdentityProvider** resource with a provider name that exists, CloudFormation marks the resource CREATE_COMPLETE.
CloudTrail event shows that **CreateIdentityProvider** fails with `DuplicateProviderException`: `" already exists in user pool "` but the error is not reported to CloudFormation.
### Expected Behavior
CloudFormation reports the error from **CreateIdentityProvider** on stack events page and does not mark the resource **CREATE_COMPLETE**.
### Observed Behavior
CloudFormation invokes CreateIdentityProvider, which fails, but then marks **AWS::Cognito::UserPoolIdentityProvider** as **CREATE_COMPLETE**.
### Test Cases
**Steps to replicate issue:**
1. Create stack using template below.
2. Remove commented out UserPoolIdentityProvider2, update stack.
**Template:**
```
Resources:
CognitoUserPool:
Type: AWS::Cognito::UserPool
Properties:
UserPoolName: MyPoolOfUsers
UserPoolIdentityProvider:
Type: AWS::Cognito::UserPoolIdentityProvider
Properties:
UserPoolId: !Ref CognitoUserPool
ProviderName: "LoginWithAmazon"
ProviderDetails:
client_id: "YourLoginWithAmazonAppId"
client_secret: "YourLoginWithAmazonAppSecret"
authorize_scopes: "profile postal_code"
ProviderType: "LoginWithAmazon"
AttributeMapping:
email: "email"
# UserPoolIdentityProvider2:
# Type: AWS::Cognito::UserPoolIdentityProvider
# Properties:
# UserPoolId: !Ref CognitoUserPool
# ProviderName: "LoginWithAmazon"
# ProviderDetails:
# client_id: "YourLoginWithAmazonAppId"
# client_secret: "YourLoginWithAmazonAppSecret"
# authorize_scopes: "profile postal_code"
# ProviderType: "LoginWithAmazon"
# AttributeMapping:
# email: "email"
```
### Other Details
[AWS::Cognito::UserPoolIdentityProvider](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolidentityprovider.html)
[CreateIdentityProvider](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html)
Contributor guide
Research direction
Reproduce the issue with the provided CloudFormation template by creating the duplicate AWS::Cognito::UserPoolIdentityProvider and reviewing the stack events and CloudTrail CreateIdentityProvider result. Done means the DuplicateProviderException is reported in CloudFormation and the resource is not marked CREATE_COMPLETE.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 20/100