Serverless-application-model: Unable to update CognitoUserPool. CloudFormation stack update failes.

[vasylk]

Apparently there is an issue with UserPool update - not possible to modify UserPool properties at all.

The stack update fails with:

• Status UPDATE_FAILED
• Type: AWS::Cognito::UserPool
• Status reason: Internal Failure

Details:

• AWS Region: eu-central-1
• The only parameter that was changed RequreNumbers from true to false

   Type: "AWS::Cognito::UserPool"
   Properties:
      ..... (more properties)
      Policies:
    PasswordPolicy:
      RequireNumbers: false
          .....(more properties)

And second issue with LambdaTriggers for UserPool, which are a part of the same CloudFormation stack.
After the stack is successfully created, LamdaTriggers fail to execute with AccessDenied Exception. Lamda functions are mapped correcly as Triggers.

The remedy for this is to go to AWS Console/UserPool properties/Triggers and just "Save changes" without changing anything.

[kskory]

For you second issue (AccessDenied) you have to add permissions for user pool to execute lambda, you can do it in CF like that:

  CognitoPostAuthLambaPermission:
    Type: "AWS::Lambda::Permission"
    Properties:
      Action: "lambda:InvokeFunction"
      FunctionName: !Ref PostAuthLambdaHandler
      Principal: "cognito-idp.amazonaws.com"
      SourceArn: !GetAtt CognitoUserPool.Arn

And about your fist issue, I saw something similar when trying to update "AWS::Cognito::UserPoolClient". It fails with Internal Failure.
It looks like there's some problem even in Cognito UI. It fails when you try to update the ClientName if you don't click "show details" first.

[vasylk]

@kskory thanks for the "Lambda Permission" hint. It solved "AccessDenied" issue with Triggers.

[unscriptable]

I'm seeing the same "Internal Failure" issues (as well as several other issues with Cognito User Pools in CF). It seems half baked. :(

[lafiosca]

These look like general CloudFormation issues not specific to SAM. I think you might be better off asking in the AWS forums (although my question there about AWS::Cognito::UserPoolClient from last week has yet to be answered).

[vasylk]

It seems the issue has been fixed.