Skip to content

Commit 1d444df

Browse files
awslujaawsluja
authored
fix: SAML deployments (#1075)
* fix: IAM arns should not include region * chore: add changeset
1 parent a777488 commit 1d444df

File tree

3 files changed

+6
-168
lines changed

3 files changed

+6
-168
lines changed

‎.changeset/odd-shirts-collect.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
'@aws-amplify/auth-construct-alpha': patch
3+
---
4+
5+
Fix deployment bug with SAML providers.

‎packages/auth-construct/src/construct.test.ts‎

Lines changed: 1 addition & 143 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import { beforeEach, describe, it, mock } from 'node:test';
22
import { AmplifyAuth } from './construct.js';
33
import { App, SecretValue, Stack } from 'aws-cdk-lib';
4-
import { Match, Template } from 'aws-cdk-lib/assertions';
4+
import { Template } from 'aws-cdk-lib/assertions';
55
import assert from 'node:assert';
66
import {
77
BackendOutputEntry,
@@ -1399,25 +1399,6 @@ void describe('Auth construct', () => {
13991399
ProviderName: oidcProviderName,
14001400
ProviderType: 'OIDC',
14011401
});
1402-
template.hasResourceProperties('AWS::Cognito::IdentityPool', {
1403-
OpenIdConnectProviderARNs: [
1404-
Match.objectEquals({
1405-
'Fn::Join': [
1406-
'',
1407-
[
1408-
'arn:aws:iam:',
1409-
{ Ref: 'AWS::Region' },
1410-
':',
1411-
{ Ref: 'AWS::AccountId' },
1412-
':oidc-provider/cognito-idp.',
1413-
{ Ref: 'AWS::Region' },
1414-
'.amazonaws.com/',
1415-
{ Ref: 'testMyOidcProviderOidcIDP837BDEAD' },
1416-
],
1417-
],
1418-
}),
1419-
],
1420-
});
14211402
});
14221403
void it('oidc defaults to GET for oidc method', () => {
14231404
const app = new App();
@@ -1482,25 +1463,6 @@ void describe('Auth construct', () => {
14821463
ProviderName: oidcProviderName,
14831464
ProviderType: 'OIDC',
14841465
});
1485-
template.hasResourceProperties('AWS::Cognito::IdentityPool', {
1486-
OpenIdConnectProviderARNs: [
1487-
Match.objectEquals({
1488-
'Fn::Join': [
1489-
'',
1490-
[
1491-
'arn:aws:iam:',
1492-
{ Ref: 'AWS::Region' },
1493-
':',
1494-
{ Ref: 'AWS::AccountId' },
1495-
':oidc-provider/cognito-idp.',
1496-
{ Ref: 'AWS::Region' },
1497-
'.amazonaws.com/',
1498-
{ Ref: 'testMyOidcProviderOidcIDP837BDEAD' },
1499-
],
1500-
],
1501-
}),
1502-
],
1503-
});
15041466
});
15051467
void it('supports oidc and phone', () => {
15061468
const app = new App();
@@ -1531,25 +1493,6 @@ void describe('Auth construct', () => {
15311493
'AWS::Cognito::UserPoolIdentityProvider',
15321494
ExpectedOidcIDPProperties
15331495
);
1534-
template.hasResourceProperties('AWS::Cognito::IdentityPool', {
1535-
OpenIdConnectProviderARNs: [
1536-
Match.objectEquals({
1537-
'Fn::Join': [
1538-
'',
1539-
[
1540-
'arn:aws:iam:',
1541-
{ Ref: 'AWS::Region' },
1542-
':',
1543-
{ Ref: 'AWS::AccountId' },
1544-
':oidc-provider/cognito-idp.',
1545-
{ Ref: 'AWS::Region' },
1546-
'.amazonaws.com/',
1547-
{ Ref: 'testMyOidcProviderOidcIDP837BDEAD' },
1548-
],
1549-
],
1550-
}),
1551-
],
1552-
});
15531496
});
15541497
void it('supports multiple oidc providers', () => {
15551498
const app = new App();
@@ -1590,40 +1533,6 @@ void describe('Auth construct', () => {
15901533
'AWS::Cognito::UserPoolIdentityProvider',
15911534
ExpectedOidcIDPProperties2
15921535
);
1593-
template.hasResourceProperties('AWS::Cognito::IdentityPool', {
1594-
OpenIdConnectProviderARNs: [
1595-
Match.objectEquals({
1596-
'Fn::Join': [
1597-
'',
1598-
[
1599-
'arn:aws:iam:',
1600-
{ Ref: 'AWS::Region' },
1601-
':',
1602-
{ Ref: 'AWS::AccountId' },
1603-
':oidc-provider/cognito-idp.',
1604-
{ Ref: 'AWS::Region' },
1605-
'.amazonaws.com/',
1606-
{ Ref: 'testMyOidcProviderOidcIDP837BDEAD' },
1607-
],
1608-
],
1609-
}),
1610-
Match.objectEquals({
1611-
'Fn::Join': [
1612-
'',
1613-
[
1614-
'arn:aws:iam:',
1615-
{ Ref: 'AWS::Region' },
1616-
':',
1617-
{ Ref: 'AWS::AccountId' },
1618-
':oidc-provider/cognito-idp.',
1619-
{ Ref: 'AWS::Region' },
1620-
'.amazonaws.com/',
1621-
{ Ref: 'testMyOidcProvider2OidcIDP43D7B07B' },
1622-
],
1623-
],
1624-
}),
1625-
],
1626-
});
16271536
});
16281537
void it('supports saml and email', () => {
16291538
const app = new App();
@@ -1653,23 +1562,6 @@ void describe('Auth construct', () => {
16531562
'AWS::Cognito::UserPoolIdentityProvider',
16541563
ExpectedSAMLIDPProperties
16551564
);
1656-
template.hasResourceProperties('AWS::Cognito::IdentityPool', {
1657-
SamlProviderARNs: [
1658-
Match.objectEquals({
1659-
'Fn::Join': [
1660-
'',
1661-
[
1662-
'arn:aws:iam:',
1663-
{ Ref: 'AWS::Region' },
1664-
':',
1665-
{ Ref: 'AWS::AccountId' },
1666-
':saml-provider/',
1667-
{ Ref: 'testSamlIDP7B98F3F4' },
1668-
],
1669-
],
1670-
}),
1671-
],
1672-
});
16731565
});
16741566
void it('supports saml and phone', () => {
16751567
const app = new App();
@@ -1699,23 +1591,6 @@ void describe('Auth construct', () => {
16991591
'AWS::Cognito::UserPoolIdentityProvider',
17001592
ExpectedSAMLIDPProperties
17011593
);
1702-
template.hasResourceProperties('AWS::Cognito::IdentityPool', {
1703-
SamlProviderARNs: [
1704-
Match.objectEquals({
1705-
'Fn::Join': [
1706-
'',
1707-
[
1708-
'arn:aws:iam:',
1709-
{ Ref: 'AWS::Region' },
1710-
':',
1711-
{ Ref: 'AWS::AccountId' },
1712-
':saml-provider/',
1713-
{ Ref: 'testSamlIDP7B98F3F4' },
1714-
],
1715-
],
1716-
}),
1717-
],
1718-
});
17191594
});
17201595
void it('supports saml via URL and email', () => {
17211596
const app = new App();
@@ -1745,23 +1620,6 @@ void describe('Auth construct', () => {
17451620
'AWS::Cognito::UserPoolIdentityProvider',
17461621
ExpectedSAMLIDPViaURLProperties
17471622
);
1748-
template.hasResourceProperties('AWS::Cognito::IdentityPool', {
1749-
SamlProviderARNs: [
1750-
Match.objectEquals({
1751-
'Fn::Join': [
1752-
'',
1753-
[
1754-
'arn:aws:iam:',
1755-
{ Ref: 'AWS::Region' },
1756-
':',
1757-
{ Ref: 'AWS::AccountId' },
1758-
':saml-provider/',
1759-
{ Ref: 'testSamlIDP7B98F3F4' },
1760-
],
1761-
],
1762-
}),
1763-
],
1764-
});
17651623
});
17661624

17671625
void it('supports additional oauth settings', () => {

‎packages/auth-construct/src/construct.ts‎

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ import {
3939
} from '@aws-amplify/backend-output-storage';
4040
import * as path from 'path';
4141
import { coreAttributeNameMap } from './string_maps.js';
42-
import { build as arnBuilder } from '@aws-sdk/util-arn-parser';
4342

4443
type DefaultRoles = { auth: Role; unAuth: Role };
4544
type IdentityProviderSetupResult = {
@@ -316,30 +315,6 @@ export class AmplifyAuth
316315
];
317316
// add other providers
318317
identityPool.supportedLoginProviders = providerSetupResult.oAuthMappings;
319-
if (providerSetupResult.oidc) {
320-
const oidcArns = [];
321-
for (const oidcProvider of providerSetupResult.oidc) {
322-
oidcArns.push(
323-
arnBuilder({
324-
service: 'iam',
325-
region,
326-
accountId: Stack.of(this).account,
327-
resource: `oidc-provider/cognito-idp.${region}.amazonaws.com/${oidcProvider.providerName}`,
328-
})
329-
);
330-
}
331-
identityPool.openIdConnectProviderArns = oidcArns;
332-
}
333-
if (providerSetupResult.saml) {
334-
identityPool.samlProviderArns = [
335-
arnBuilder({
336-
service: 'iam',
337-
region,
338-
accountId: Stack.of(this).account,
339-
resource: `saml-provider/${providerSetupResult.saml.providerName}`,
340-
}),
341-
];
342-
}
343318
return {
344319
identityPool,
345320
identityPoolRoleAttachment,

0 commit comments

Comments
 (0)