api-gateway: Unable to create cross-partition Cognito User Pool Authorizer
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
I want to authenticate an api gateway rest api in us commercial cloud to a Cognito User Pool in us-gov cloud. When I try this, I get `ProviderARNs need to be valid Cognito Userpools`.
I know I can make my own token authorizer or request authorizer, but a user pool authorizer would be more convenient.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Version
_No response_
### Expected Behavior
Authorizer is created
### Current Behavior
Authorizer is not created, and CDK deployment fails with `ProviderARNs need to be valid Cognito Userpools. Invalid ARNs-
arn:aws-us-gov:cognito-idp:us-gov-west-1:...`
### Reproduction Steps
```
// cdk project running in us-west-2, for example
const userPool = UserPool.fromUserPoolArn(this,'eup', )
const authorizer = new CognitoUserPoolsAuthorizer(this, 'apiauth', {
cognitoUserPools: [
userPool
],
})
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.162.0 (build c8d7dd3)
### Framework Version
_No response_
### Node.js Version
v20.17.0
### OS
macOS
### Language
TypeScript
### Language Version
5.6.2
### Other information
_No response_
Contributor guide
Research direction
Start by tracing CognitoUserPoolsAuthorizer and UserPool.fromUserPoolArn using the supplied TypeScript reproduction. Check how the authorizer validates the cross-partition Cognito ARN, then verify that an API Gateway REST API in the commercial cloud can be created with the us-gov user pool and the deployment no longer reports an invalid ARN.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- api, authentication, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100