UserPoolClient - Retrieving the client secret requires an unnecessary custom resource
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
A change was merged previously to CDK to support a workaround for getting the client secret. This custom resource requires someone deploying a stack with only cognito to have a VPC attachment to the custom resource for accounts with SCPs limiting lambdas to have to run in a VPC.
### Expected Behavior
Native CFN is used to get Cognito Client Secrets
### Current Behavior
As implemented here, a custom resource is used to get the client secret:
https://github.com/aws/aws-cdk/pull/21262/files#diff-9713362aa6af827d0bf2a8c68319b5bb9c74f888f9ab417266ff1b98aa121ae2R429
### Reproduction Steps
create a cognito app client w/ secret
```python
self.client = user_pool.add_client(
"service-client",
user_pool_client_name="service-client",
supported_identity_providers=[
aws_cognito.UserPoolClientIdentityProvider.COGNITO
],
o_auth=self.o_auth_settings,
auth_flows=aws_cognito.AuthFlow(
user_srp=True,
),
refresh_token_validity=Duration.days(1),
generate_secret=True,
)
self.my_secret = SecretValue.unsafe_unwrap(self.client.user_pool_client_secret)
```
### Possible Solution
Since the CFN Attribute was fixed in 2023,
Remove the custom resource and instead generate the following CFN during synth to access the client secret:
```json
"UserPoolClientIdSecret":{
"Value": {
"Fn::GetAtt": ["CognitoUserPoolClient", "ClientSecret"]
}
}
```
### Additional Information/Context
_No response_
### CDK CLI Version
2.117.0
### Framework Version
_No response_
### Node.js Version
v18.17.1
### OS
OSX Sonoma
### Language
Python
### Language Version
3.10.11
### Other information
_No response_
Contributor guide
Research direction
Start at the Cognito UserPoolClient implementation and the custom-resource path identified by the linked pull request diff. Verify how the client secret is exposed during synthesis, then confirm the resulting CloudFormation uses the Cognito ClientSecret Fn::GetAtt and no longer requires the custom resource or VPC attachment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- authentication, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100