aws-cdk: [cognito] can't add cognito trigger after UserPool.fromUserPoolId

I was not able to get the above solution working as I did not have access to the underlying CfnUserPool via fromUserPoolId or node.defaultChild.

I was however able to add triggers to a user pool imported via fromUserPoolId by using a custom resource:

    const userPool = Cognito.UserPool.fromUserPoolId(this, "UserPool", userPoolId);

    new CustomResources.AwsCustomResource(this, "UpdateUserPool", {
      resourceType: "Custom::UpdateUserPool",
      onCreate: {
        region: this.region,
        service: "CognitoIdentityServiceProvider",
        action: "updateUserPool",
        parameters: {
          UserPoolId: userPool.userPoolId,
          LambdaConfig: {
            PreSignUp: preSignUpHandler.functionArn,
            DefineAuthChallenge: defineAuthChallengeHandler.functionArn,
            CreateAuthChallenge: createAuthChallengeHandler.functionArn,
            VerifyAuthChallengeResponse: verifyAuthChallengeResponseHandler.functionArn,
          },
        },
        physicalResourceId: CustomResources.PhysicalResourceId.of(userPool.userPoolId),
      },
      policy: CustomResources.AwsCustomResourcePolicy.fromSdkCalls({ resources: CustomResources.AwsCustomResourcePolicy.ANY_RESOURCE }),
    });

⚠️ Warning about using CustomResource with API Call to UpdateUserPool ⚠️

We are using the CustomResource to update the cognito user pool with the api call of updateUserPool, like https://github.com/aws/aws-cdk/issues/10002#issuecomment-854169838, and other attributes got change for no reason, like seeding a verification email.

If you only specify the lambda config, other attribute will be reset to the default one as documented in the API DOC

As you can see, there’s not a big emphasis on it!

I’m trying to do this inside of an amplify project using amplify add custom. It seems though since amplify at this point can’t deploy assets to S3 AwsCustomResource is not working since they run within a lambda. Whatever I try I end up with an error message when running amplify push

Parameters:[AssetParameters4074092ab8b435c90a773e082601fa36def54c91cadfae59451bd0beda547cbcArtifactHashF236251A, AssetParameters4074092ab8b435c90a773e082601fa36def54c91cadfae59451bd0beda547cbcS3VersionKey547E84F8, AssetParameters4074092ab8b435c90a773e082601fa36def54c91cadfae59451bd0beda547cbcS3Bucket02FC0B28] must have values

My goal is to add the CustomEmailSender trigger since it’s not supported by the amplify cli yet.

FYI - After adding the triggers with a custom resource, I also had to grant invoke permission:

const invokeCognitoTriggerPermission = {
        principal: new iam.ServicePrincipal('cognito-idp.amazonaws.com'),
        sourceArn: userPool.userPoolArn
}

preSignUpHandler.addPermission('InvokePreSignUpHandlerPermission', invokeCognitoTriggerPermission)
defineAuthChallengeHandler.addPermission('InvokeDefineAuthChallengeHandlerPermission', invokeCognitoTriggerPermission)
/// etc...

@skinny85 that worked a treat! Thank you so much 🙇🏻

For anyone else encountering this issue, the solution looks like this:

const cfnPool = template.getResource("UserPool") as cognito.CfnUserPool;
cfnPool.lambdaConfig = {
  userMigration: migrate.functionArn,
};

⚠️ Warning about using CustomResource with API Call to UpdateUserPool ⚠️ We are using the CustomResource to update the cognito user pool with the api call of updateUserPool, like #10002 (comment), and other attributes got change for no reason, like seeding a verification email. If you only specify the lambda config, other attribute will be reset to the default one as documented in the API DOC As you can see, there’s not a big emphasis on it!

Is there any way to add the trigger without resetting the others? I can’t import the template

Hi, I have probably workaround 😃

I am new in AWS but I had same problem with resetting user pool changes to defaults (sending emails). I dealt with it in my project by adding custom resource with lambda which basically do three things:

1. DescribeUserPool (get current user pool config)
2. Adds postConfirmationTrigger to current LambdaConfig
3. UpdateUserPool (update not only one field but passes almost all given by DescribeUserPool)

link: https://github.com/MartinMartinni/aws-shop/blob/main/backend/src/services/user/post-confirmation-trigger/updateUserPool.ts

I know that may not be the best way but worked for me. After that sending emails is working 😃

⚠️ Warning about using CustomResource with API Call to UpdateUserPool ⚠️

We are using the CustomResource to update the cognito user pool with the api call of updateUserPool, like #10002 (comment), and other attributes got change for no reason, like seeding a verification email.

If you only specify the lambda config, other attribute will be reset to the default one as documented in the API DOC

As you can see, there’s not a big emphasis on it!

Is there any way to add the trigger without resetting the others? I can’t import the template