awslabs / awslabs/agentcore-samples

mcp-server-agentcore-runtime (Terraform): repeated apply fails with "cannot modify or remove schema items" on Cognito User Pool

Open Beginner friendly
#1,936 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
3.4k
Forks
1.3k
Avg merge
1d 22h
Merged PRs (30d)
30

Description

### Description

Deploying `04-infrastructure-as-code/terraform/mcp-server-agentcore-runtime`
does not reach the happy path on a routine re-apply. After a successful
initial `terraform apply` (or `./deploy.sh`), running `terraform apply`
again against the same state fails:
```
Error: updating Cognito User Pool (us-east-1_xxxxxxxxx): cannot modify or remove schema items

with aws_cognito_user_pool.mcp_user_pool,
on cognito.tf line 5, in resource "aws_cognito_user_pool" "mcp_user_pool":
5: resource "aws_cognito_user_pool" "mcp_user_pool" {
```
### Root cause

`cognito.tf` declares an explicit `schema` block (the `email`
attribute) on `aws_cognito_user_pool.mcp_user_pool`. Cognito silently
adds its own implicit schema attributes (`sub`, `email_verified`,
etc.) at pool-creation time that are never reflected back into the
Terraform config. On the next plan, Terraform diffs its config against
the live pool's full schema and attempts to reconcile them — but
Cognito's API refuses this unconditionally, since user pool schema is
immutable after creation.

This reproduces regardless of the caller's IAM permissions — it is not
a permissions issue, and happens identically under
`AdministratorAccess`. It surfaces on:
- Any second/subsequent `terraform apply` against a pool that already
exists (e.g. retrying after fixing an unrelated error, or any
routine re-apply/drift-detection run).

### Steps to reproduce

1. `terraform apply` (succeeds, creates the Cognito User Pool)
2. `terraform apply` again with no config changes
3. Observe the "cannot modify or remove schema items" error

### Expected behavior

`terraform apply` should be idempotent — re-running it with no
intentional changes should complete as a no-op (or only apply the
intended diff), not fail.

### Suggested fix

Add `lifecycle { ignore_changes = [schema] }` to
`aws_cognito_user_pool.mcp_user_pool` in `cognito.tf`, so Terraform
stops including the `schema` attribute in its plan/diff after initial
creation. I have a fix ready and will open a PR referencing this issue.

Contributor guide

Open the contributing guide

Research direction

Open 04-infrastructure-as-code/terraform/mcp-server-agentcore-runtime/cognito.tf and inspect the aws_cognito_user_pool.mcp_user_pool resource and its schema block. Run terraform apply twice after the initial deployment to reproduce the failure; done means the second apply completes as a no-op or applies only intended changes without the Cognito schema error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, terraform
Domain
authentication, cloud
Issue type
Bug
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.