aws / aws/aws-cdk

api-gateway: Unable to create cross-partition Cognito User Pool Authorizer

Open
#31,735 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-apigateway bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

I want to authenticate an api gateway rest api in us commercial cloud to a Cognito User Pool in us-gov cloud. When I try this, I get `ProviderARNs need to be valid Cognito Userpools`.

I know I can make my own token authorizer or request authorizer, but a user pool authorizer would be more convenient.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

Authorizer is created

### Current Behavior

Authorizer is not created, and CDK deployment fails with `ProviderARNs need to be valid Cognito Userpools. Invalid ARNs-
arn:aws-us-gov:cognito-idp:us-gov-west-1:...`

### Reproduction Steps

```
// cdk project running in us-west-2, for example

const userPool = UserPool.fromUserPoolArn(this,'eup', )

const authorizer = new CognitoUserPoolsAuthorizer(this, 'apiauth', {
cognitoUserPools: [
userPool
],
})
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.162.0 (build c8d7dd3)

### Framework Version

_No response_

### Node.js Version

v20.17.0

### OS

macOS

### Language

TypeScript

### Language Version

5.6.2

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by tracing CognitoUserPoolsAuthorizer and UserPool.fromUserPoolArn using the supplied TypeScript reproduction. Check how the authorizer validates the cross-partition Cognito ARN, then verify that an API Gateway REST API in the commercial cloud can be created with the us-gov user pool and the deployment no longer reports an invalid ARN.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
api, authentication, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.