Amplify-ios: AWSPinpointProvider - Failed to remove unused endpoints with error AccessDeniedException

[idanlo]

Describe the bug
Whenever there are 10 devices registered for a specific endpoint I get this error saying that my user is not authorized to perform mobiletargeting:GetUserEndpoints.
I believe this is related to aws-amplify/amplify-cli#5918 because you removed that specific permission.

Amplify CLI Version
4.37.1

To Reproduce

1. Create Analytics category in your backend,
2. Log into your user from the app multiple times from multiple devices,
3. Get the error after 10 devices register

Expected behavior
The user has the role to call GetUserEndpoints in order to remove unused endpoints.

Screenshots

[github-actions[bot]]

This issue is stale because it has been open for 14 days with no activity. Please, provide an update or it will be automatically closed in 7 days.

[idanlo]

Not stale

[royjit]

The issue happened after CLI has removed the specific permission. Moving to CLI repo to get more information. Please give us information on why this was removed. = https://github.com/aws-amplify/amplify-cli/pull/5918#issuecomment-742972799

[ahtokca]

same here. After upgrading to 2.41.2 (up on receiving email from AWS). I noticed GetUserEndpoints is removed from pinpoint policy. It breaks endpointUpdates with 'AccessDenied'. It's a time-bomb. I bet more people start to complain very soon

[royjit]

Raised an issue in CLI repo - https://github.com/aws-amplify/amplify-cli/issues/6608

[dylan-westbury]

Is there an eta or will this issue be resolved? We are waiting to release a fresh react native app project to the market and are unable to because push notifications stop working once it hits 15 endpoints.

We also have 2 apps in the market downgraded to lower version levels of amplify that allows removing of inactive endpoints, but it has been made apparent that they have security issues.

We really need to know as client is becoming frustrated and we don't want to introduce another push notification provider in place of pinpoint, as this will require significant change to mobile app and backend, whilst we prefer to use aws-amplify purely.

It would be super helpful if we could get some insight on why it was removed from the pinpoint policy and if it was resolved, there isn't really any explanation / linked issue on the merge that was created that has broken endpoints.

https://github.com/aws-amplify/amplify-cli/pull/5918

[GeorgeBellTMH]

The AWS team does not care about us...absolutely no comment on this from anyone in 4 months...despite 3 open PR's in js, cli and iOS, and about 6 open tickets...they should remove the pinpoint features if they won't support them...this ticket is still pending triage after 3 months...

[renebrandel]

Hi @GeorgeBellTMH - We were discussing this internally and there seems to be lots of nuance here. To make sure we provide the best experience, we'd love to jump on a call together with you, the Amplify team, and Pinpoint team. Would love to help facilitate this. Can you shoot me an email? renbran at amazon dot com

[royjit]

Hello everyone,

Pinpoint service is now detaching the oldest push notification endpoint from the user. So you do not have to do this from your end, more context here in js repo - https://github.com/aws-amplify/amplify-js/issues/7251#issuecomment-818881114
Can you please verify if this error still exists.

[GeorgeBellTMH]

Do we have to do anything to enable this. I can confirm I got this error 4 minutes ago from production...but not sure if I need to be on the latest version of amplify or if I have to do something in pinpoint to enable?