Amplify-cli: Circular dependency between resources: [functionauthPreSignup, apiapi, authauth, UpdateRolesWithIDPFunctionOutputs, UpdateRolesWithIDPFunction]

[oste]

Describe the bug

Seeing the following error after updating Auth PreSignup Trigger function to have API access permission:

⠼ Updating resources in the cloud. This may take a few minutes...Error updating cloudformation stack
✖ An error occurred when pushing the resources to the cloud

Circular dependency between resources: [functionauthPreSignup, apiapi, authauth, UpdateRolesWithIDPFunctionOutputs, UpdateRolesWithIDPFunction]

To Reproduce
Steps to reproduce the behavior:

1. amplify init
2. amplify add auth - add a preSignup trigger function
3. amplify add api
4. amplify api add-graphql-datasource - add RDS resource to the API
5. amplify push

This is where it goes bad

1. amplify function update
2. Give the preSignup trigger function(functionauthPreSignup) create permission on the api created in step 3
3. amplify push - This results in the error described above

Expected behavior
Push works as expected

Desktop (please complete the following information):

• OS: OSX
• Browser: n/a
• Version: 1.12.0

[kaustavghosh06]

@oste Yes, this is because of a circular dependency between the pre-signup-trigger (auth is depndent on this to complete first ) and then this trigger now would depend on API to complete first (Which is dependent on auth to complete first), causing a deadlock and a circular dependency:
You can unblock yourself by using a custom resource in Cloudformation to unblock and we're already tracking this as a part of this issue - #1874

[thedgbrt]

@kaustavghosh06 would you have any example of how to write that custom resource in CLoudFormation? And where to add it?

[patspam]

@kaustavghosh06 can you provide an example of the workaround? The issue you linked to is unresolved and does not show how to solve this - these sorts of issues are incredibly frustrating because they stop you dead in your tracks.

[increment-upskilling]

Another workaround: switch to using IAM authentication only for the API if you can, that'll break the cycle