aws / aws/aws-cdk

UserPoolClient - Retrieving the client secret requires an unnecessary custom resource

Open
#28,785 1 comment 5 reactions 0 assignees View on GitHub
@aws-cdk/aws-cognito bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

A change was merged previously to CDK to support a workaround for getting the client secret. This custom resource requires someone deploying a stack with only cognito to have a VPC attachment to the custom resource for accounts with SCPs limiting lambdas to have to run in a VPC.

### Expected Behavior

Native CFN is used to get Cognito Client Secrets

### Current Behavior

As implemented here, a custom resource is used to get the client secret:
https://github.com/aws/aws-cdk/pull/21262/files#diff-9713362aa6af827d0bf2a8c68319b5bb9c74f888f9ab417266ff1b98aa121ae2R429

### Reproduction Steps

create a cognito app client w/ secret

```python
self.client = user_pool.add_client(
"service-client",
user_pool_client_name="service-client",
supported_identity_providers=[
aws_cognito.UserPoolClientIdentityProvider.COGNITO
],
o_auth=self.o_auth_settings,
auth_flows=aws_cognito.AuthFlow(
user_srp=True,
),
refresh_token_validity=Duration.days(1),
generate_secret=True,
)

self.my_secret = SecretValue.unsafe_unwrap(self.client.user_pool_client_secret)
```

### Possible Solution

Since the CFN Attribute was fixed in 2023,
Remove the custom resource and instead generate the following CFN during synth to access the client secret:

```json
"UserPoolClientIdSecret":{
"Value": {
"Fn::GetAtt": ["CognitoUserPoolClient", "ClientSecret"]
}
}
```

### Additional Information/Context

_No response_

### CDK CLI Version

2.117.0

### Framework Version

_No response_

### Node.js Version

v18.17.1

### OS

OSX Sonoma

### Language

Python

### Language Version

3.10.11

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the Cognito UserPoolClient implementation and the custom-resource path identified by the linked pull request diff. Verify how the client secret is exposed during synthesis, then confirm the resulting CloudFormation uses the Cognito ClientSecret Fn::GetAtt and no longer requires the custom resource or VPC attachment.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authentication, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.