amplify-cli: `GRAPHQLAPIIDOUTPUT` and `GRAPHQLAPIENDPOINTOUTPUT` are not set

@edwardfoyle I’m getting the same error with Amplify CLI Version 4.18.1. When I run amplify mock it’s returned: Could not find ref for "apideliveringHopeApiGraphQLAPIIdOutput". Using unsubstituted value. Could not find ref for "apideliveringHopeApiGraphQLAPIEndpointOutput". Using unsubstituted value.

I added the function using the command amplify add function.

This is the content of the root stack CFN file:

{
  'AWSTemplateFormatVersion': '2010-09-09',
  'Description': 'Root stack for the Amplify AWS CloudFormation provider',
  'Parameters':
    {
      'DeploymentBucketName':
        {
          'Description': 'Name of the common deployment bucket provided by the parent stack',
          'Type': 'String',
          'Default': 'DeploymentBucket',
        },
      'AuthRoleName': { 'Type': 'String', 'Default': 'AuthRoleName' },
      'UnauthRoleName': { 'Type': 'String', 'Default': 'UnauthRoleName' },
    },
  'Resources':
    {
      'DeploymentBucket':
        {
          'Type': 'AWS::S3::Bucket',
          'DeletionPolicy': 'Retain',
          'Properties': { 'BucketName': { 'Ref': 'DeploymentBucketName' } },
        },
      'AuthRole':
        {
          'Type': 'AWS::IAM::Role',
          'Properties':
            {
              'RoleName': { 'Ref': 'AuthRoleName' },
              'AssumeRolePolicyDocument':
                {
                  'Version': '2012-10-17',
                  'Statement':
                    [
                      {
                        'Sid': '',
                        'Effect': 'Deny',
                        'Principal':
                          { 'Federated': 'cognito-identity.amazonaws.com' },
                        'Action': 'sts:AssumeRoleWithWebIdentity',
                      },
                    ],
                },
            },
        },
      'UnauthRole':
        {
          'Type': 'AWS::IAM::Role',
          'Properties':
            {
              'RoleName': { 'Ref': 'UnauthRoleName' },
              'AssumeRolePolicyDocument':
                {
                  'Version': '2012-10-17',
                  'Statement':
                    [
                      {
                        'Sid': '',
                        'Effect': 'Deny',
                        'Principal':
                          { 'Federated': 'cognito-identity.amazonaws.com' },
                        'Action': 'sts:AssumeRoleWithWebIdentity',
                      },
                    ],
                },
            },
        },
      'apideliveringHopeApi':
        {
          'Type': 'AWS::CloudFormation::Stack',
          'Properties':
            {
              'TemplateURL': 'https://s3.amazonaws.com/amplify-delivering-hope-dev-05757-deployment/amplify-cfn-templates/api/cloudformation-template.json',
              'Parameters':
                {
                  'CreateAPIKey': 1,
                  'AppSyncApiName': 'deliveringHopeApi',
                  'DynamoDBBillingMode': 'PAY_PER_REQUEST',
                  'DynamoDBEnableServerSideEncryption': 'false',
                  'S3DeploymentBucket': 'amplify-delivering-hope-dev-05757-deployment',
                  'S3DeploymentRootKey': 'amplify-appsync-files/f1707bbc80fae28c61d20a6f994539ff9fed4ee4',
                  'env': 'dev',
                },
            },
        },
      'functionlistOtherCompanyProducts':
        {
          'Type': 'AWS::CloudFormation::Stack',
          'Properties':
            {
              'TemplateURL': 'https://s3.amazonaws.com/amplify-delivering-hope-dev-05757-deployment/amplify-cfn-templates/function/listOtherCompanyProducts-cloudformation-template.json',
              'Parameters':
                {
                  'apideliveringHopeApiGraphQLAPIIdOutput':
                    {
                      'Fn::GetAtt':
                        ['apideliveringHopeApi', 'Outputs.GraphQLAPIIdOutput'],
                    },
                  'apideliveringHopeApiGraphQLAPIEndpointOutput':
                    {
                      'Fn::GetAtt':
                        [
                          'apideliveringHopeApi',
                          'Outputs.GraphQLAPIEndpointOutput',
                        ],
                    },
                  'env': 'dev',
                },
            },
        },
    },
  'Outputs':
    {
      'Region':
        {
          'Description': 'CloudFormation provider root stack Region',
          'Value': { 'Ref': 'AWS::Region' },
          'Export': { 'Name': { 'Fn::Sub': '${AWS::StackName}-Region' } },
        },
      'StackName':
        {
          'Description': 'CloudFormation provider root stack ID',
          'Value': { 'Ref': 'AWS::StackName' },
          'Export': { 'Name': { 'Fn::Sub': '${AWS::StackName}-StackName' } },
        },
      'StackId':
        {
          'Description': 'CloudFormation provider root stack name',
          'Value': { 'Ref': 'AWS::StackId' },
          'Export': { 'Name': { 'Fn::Sub': '${AWS::StackName}-StackId' } },
        },
      'DeploymentBucketName':
        {
          'Description': 'CloudFormation provider root stack deployment bucket name',
          'Value': { 'Ref': 'DeploymentBucketName' },
          'Export':
            { 'Name': { 'Fn::Sub': '${AWS::StackName}-DeploymentBucketName' } },
        },
      'AuthRoleArn': { 'Value': { 'Fn::GetAtt': ['AuthRole', 'Arn'] } },
      'UnauthRoleArn': { 'Value': { 'Fn::GetAtt': ['UnauthRole', 'Arn'] } },
      'AuthRoleName': { 'Value': { 'Ref': 'AuthRole' } },
      'UnauthRoleName': { 'Value': { 'Ref': 'UnauthRole' } },
    },
}

I just ran onto this too … tried adding auth. See the values but the path is pathname: ‘apiassetAPIGraphQLAPIEndpointOutput’ },

I was going so fast until I hit DynamoDB, pivoted to GraphQL and I’m almost equally sad.

Follow up on a behavior I noticed. If you start off with Cognito User pools, and then pivot to IAM or apiKey for say a Lambda to write to DynamoDB – it seems to re-arrange the default auth as opposed to add other available auth types. I was able to thankfully diff recent changes across many files and notice my block of auth types changed. So this of course can break the frontend. I’ve swapped my work to making smaller incremental changes so I don’t get in a bind. I also had cases where if a S3 Trigger had a policy and then I added another policy for DynamoDB or GraphQL the policy names collided resulting in a circular dependency. I just had to go in and prefix these policy names so they wouldn’t conflict.

I was facing a similar issue when adding/updating a function to the cloud.

On a new project I tried to grant permissions to API and Auth resources like this:

? Provide a friendly name for your resource to be used as a label for this category in the project: signupuser
? Provide the AWS Lambda function name: signupuser
? Choose the function runtime that you want to use: NodeJS
? Choose the function template that you want to use: Hello World
? Do you want to access other resources created in this project from your Lambda function? Yes
? Select the category api, auth
Api category has a resource called revampxp
? Select the operations you want to permit for revampxp create, read
Auth category has a resource called revampxp
? Select the operations you want to permit for revampxp read

As you can see, I had the same friendly name for the API and Auth resources.

When pushing the function I got the message: Template format error: Unresolved resource dependencies [authrevampxpUserPoolId] in the Resources block of the template

The function env variables were: API_REVAMPXP_GRAPHQLAPIENDPOINTOUTPUT - Correctly set API_REVAMPXP_GRAPHQLAPIIDOUTPUT - Correctly set AUTH_REVAMPXP_USERPOOLID - Set with default value

Then I started a new project with exactly the same configuration and model. I just let the Auth resource name generated by the cli. So that this name be different than the API resource name.

I added a new function:

? Provide a friendly name for your resource to be used as a label for this category in the project: signupuser
? Provide the AWS Lambda function name: signupuser
? Choose the function runtime that you want to use: NodeJS
? Choose the function template that you want to use: Hello World
? Do you want to access other resources created in this project from your Lambda function? Yes
? Select the category api, auth
Api category has a resource called revampxp
? Select the operations you want to permit for revampxp create, read
Auth category has a resource called revampxp4b40879a4b40879a
? Select the operations you want to permit for revampxp4b40879a4b40879a read

And it worked. No errors in the console, and env variables correctly set in the function.

So do you have resources with the same name?