amplify-cli: Cognito Trigger templates' return and permissions issue

I’m having the same issue with the circular dependencies, but trying to get access to a DynamoDB table with still no luck, only getting errors when trying to deploy.

I think it’s extremely bad that this issues has been around since 2019 and there’s still no actual fix in the roadmap, we need to do this ‘hacky’ way to do things as simple as reading from a database before a user signs-up.

Even the official documentation has a way of doing this use case, but this wouldn’t work on a real world scenario as the selected triggers through the console will be overwritten every time you update any other. I think this should be prioritized as it renders the trigger functions basically useless except for really basic operations like sending e-mails.

I “solved” this by modifying custom-policies.json as follows:

[
  {
    "Effect": "Allow",
    "Action": [
      "cognito-idp:CreateGroup",
      "cognito-idp:AdminAddUserToGroup"
    ],
    "Resource": [
      "<MY HARD-CODED USERPOOL ARN FROM THE ERROR MESSAGE>"
    ]
  }
]

Amplify team, wanted to ask what’s your approach to semi-permanent bugs like this, when Cognito trigger Lambdas can not access GraphQL API? Like everybody else, I’ve run into number of these, I slowly find and implement workarounds - great its there… somewhere. And sometimes they are in triple-chained closed issues like this one.

This is however a very inefficient process of development. These issues been around for so long time that maybe you can get fixed links and the solutions discovered more easily? I’d rather go via official docs that links outstanding ticket that comb through outstanding ticket trying to find a solution to a common problem

@acusti Since “Resource” is an array, you can just add each of your user pool ARNs in that array.

[
  {
    "Action": [
      "cognito-idp:AdminAddUserToGroup",
      "cognito-idp:CreateGroup",
      "cognito-idp:GetGroup"
    ],
    "Resource": [
      "<DEV USERPOOL ARN>",
      "<MAIN USERPOOL ARN>",
    ]
  }
]

@scottmcmaster’s workaround worked for me, though i had to also add "cognito-idp:GetGroup" to the Action array:

[
  {
    "Action": [
      "cognito-idp:AdminAddUserToGroup",
      "cognito-idp:CreateGroup",
      "cognito-idp:GetGroup"
    ],
    "Resource": [
      "<HARD-CODED USERPOOL ARN FROM THE ERROR MESSAGE>"
    ]
  }
]

it would solve it for me completely if i could use a string as the resource ARN that would switch between my dev environment userpool ARN and my main environment userpool ARN. does anyone know if that is possible using custom-policies.json?

I have this problem and it involves a lot of manual work. For fresh backend deployment, do amplify push first, update this file with ARN and do another push. When team members deploy their own backend, they have to modify the custom-policies.json file with their ARN and remember not to check it in and back it up during branch switching, etc. It would really help to have this happen automatically when we allow the lambda function to access other resources.