awslabs / awslabs/agentcore-samples
mcp-server-agentcore-runtime (Terraform): repeated apply fails with "cannot modify or remove schema items" on Cognito User Pool
- Dominant language
- Python
- Stars
- 3.4k
- Forks
- 1.3k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 30
Description
### Description
Deploying `04-infrastructure-as-code/terraform/mcp-server-agentcore-runtime`
does not reach the happy path on a routine re-apply. After a successful
initial `terraform apply` (or `./deploy.sh`), running `terraform apply`
again against the same state fails:
```
Error: updating Cognito User Pool (us-east-1_xxxxxxxxx): cannot modify or remove schema items
with aws_cognito_user_pool.mcp_user_pool,
on cognito.tf line 5, in resource "aws_cognito_user_pool" "mcp_user_pool":
5: resource "aws_cognito_user_pool" "mcp_user_pool" {
```
### Root cause
`cognito.tf` declares an explicit `schema` block (the `email`
attribute) on `aws_cognito_user_pool.mcp_user_pool`. Cognito silently
adds its own implicit schema attributes (`sub`, `email_verified`,
etc.) at pool-creation time that are never reflected back into the
Terraform config. On the next plan, Terraform diffs its config against
the live pool's full schema and attempts to reconcile them — but
Cognito's API refuses this unconditionally, since user pool schema is
immutable after creation.
This reproduces regardless of the caller's IAM permissions — it is not
a permissions issue, and happens identically under
`AdministratorAccess`. It surfaces on:
- Any second/subsequent `terraform apply` against a pool that already
exists (e.g. retrying after fixing an unrelated error, or any
routine re-apply/drift-detection run).
### Steps to reproduce
1. `terraform apply` (succeeds, creates the Cognito User Pool)
2. `terraform apply` again with no config changes
3. Observe the "cannot modify or remove schema items" error
### Expected behavior
`terraform apply` should be idempotent — re-running it with no
intentional changes should complete as a no-op (or only apply the
intended diff), not fail.
### Suggested fix
Add `lifecycle { ignore_changes = [schema] }` to
`aws_cognito_user_pool.mcp_user_pool` in `cognito.tf`, so Terraform
stops including the `schema` attribute in its plan/diff after initial
creation. I have a fix ready and will open a PR referencing this issue.
Contributor guide
Research direction
Open 04-infrastructure-as-code/terraform/mcp-server-agentcore-runtime/cognito.tf and inspect the aws_cognito_user_pool.mcp_user_pool resource and its schema block. Run terraform apply twice after the initial deployment to reproduce the failure; done means the second apply completes as a no-op or applies only intended changes without the Cognito schema error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, terraform
- Domain
- authentication, cloud
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100