Security related to committing aws-exports.js

** Which Category is your question related to? ** Auth and Amplify Console Deploy

** What AWS Services are you utilizing? ** AWS Amplify Console Deploy and AWS Cognito

** Provide additional details e.g. code snippets ** Hi folks,

I recently generated a new Amplify project using the latest beta version (0.2.1-multienv.35) of Amplify CLI to try out Amplify Console Deploy. After setting up Cognito Auth using the Amplify CLI and connecting my GitHub repo to Amplify Console and pushing to GitHub, Amplify Console Deploy started a build. The build failed with an error because it couldn’t find ./src/aws-exports.js. I noticed amplify init adds aws-exports.js to my project’s .gitignore file. How sensitive is this file? If it is sensitive, what’s the best way to use AWS Amplify Console Deploy without committing it? Is that possible?

Thanks!

[undefobj]

@cmoel in answer to your question around sensitivity this is fine for an SPA as the items are used for constructing HTTP requests to the appropriate endpoints in your account. See https://github.com/aws-amplify/amplify-js/issues/2495#issuecomment-453282477 for a similar question in the past.

[cmoel]

The backend and frontend deploy are working successfully now. Thank you all so much for your patience and clear explanations! Also, thank you for seeing this through to the end when my concerns shifted from “is it safe to commit this file to git?” to “how do I deploy both a backend and a frontend using the Amplify Console?”

There are still some issues I need to iron out around using the correct Cognito Auth User Pool and Identity Pool (since the backend deployment deleted both of them) but that seems well outside the scope of this issue. I’ll open another issue if I can’t figure it out.

Thanks again!