aws / aws/aws-cdk

(aws_cognito): UserPool Lambda triggers do not allow specifying a function ALIAS.

Open
#34,479 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-cognito feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the feature

Lambda Provisioned Concurrency can be configured only against a function version or alias, so we wondered what alias/version gets invoked by Cognito for auth triggers. Quoting the [AWS Doc](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#important-lambda-considerations):

> You can't declare a function version in your Lambda trigger configuration. Amazon Cognito user pools invoke the latest version of your function by default. However, you can associate a function version with an alias and set your trigger LambdaArn to the alias ARN in a [CreateUserPool](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPool.html) or [UpdateUserPool](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPool.html) API request.

AWS CDK's `.addTrigger` currently does not support specifying a function ALIAS to invoke:

```ts
addTrigger(operation: UserPoolOperation, fn: lambda.IFunction, lambdaVersion?: LambdaVersion): void;
```

### Use Case

The use case is being able to use Lambda Provisioned Concurrency for our triggers.

In particular, the `PreTokenGeneration` trigger is crucial. When the Lambda requires access to the VPC to handle requests, the cold-start takes 5-8 seconds. It is an unacceptable amount of time to wait for a sign-in or session renewal in 2025.

### Proposed Solution

The UserPool's `.addTrigger` should support specifying a function ALIAS. It should not be mandatory, and could default to `$LATEST` (which would be the same than not specifying it at all, like I guess it is right now).

```ts
addTrigger(operation: UserPoolOperation, fn: lambda.IFunction, lambdaVersion?: LambdaVersion): void;
```

### Other Information

_No response_

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.193.0

### AWS CDK CLI version

2.1012.0

### Environment details (OS name and version, etc.)

Mac OS 14.6.1

Contributor guide

Open the contributing guide

Research direction

Start at the UserPool.addTrigger entry point and review how its lambdaVersion argument maps to the CreateUserPool and UpdateUserPool APIs. The work is done when callers can optionally specify a function alias for the Cognito trigger while existing calls retain their current behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.