Error running server-side within Lambda

Describe the bug I’m trying to use Amplify server-side within Lambda in order to de-couple the Cognito token & session management from our clients. If I run my Lambda function locally with sam-cli, login is successful. However, it fails when deployed to AWS. I’ve traced the code to the authenticateUser function.

The error message I receive in the Lambda logs seems like the username isn’t being passed into the Cognito call:

"Please provide an `arn`, `name` or `phone` number"  

I have a very basic user pool, email as username and no triggers. Also, my Lambda’s execution role has full access to Cognito.

To Reproduce I tried using the Amplify function:

Auth.signIn({
    username,
    password
  });

as well as using amazon-cognito-identity-js lib directly.

const userPoolData = new CognitoUserPool({
    UserPoolId: process.env.COGNITO_USER_POOL_ID,
    ClientId: process.env.COGNITO_CLIENT_ID
  });
  const userData = {
    Username: username,
    Pool: userPoolData
  };
  const user = new CognitoUser(userData);
  const authDetails = new AuthenticationDetails({
    Username: username,
    Password: password
    // ValidationData: { },
  });

  return new Promise((resolve, reject) => {
    user.authenticateUser(authDetails, {
      onSuccess: resolve,
      onFailure: reject,
    });

Expected behavior I should be able to sign in from a Lambda function that’s deployed to AWS. This works from a local Lambda

Additional context My versions are:

  "amazon-cognito-identity-js": "^3.0.7",
  "aws-amplify": "^1.1.19",
   "aws-sdk": "^2.279.1",

My Amplify config is:

Amplify.configure({
  Auth: {
    identityPoolId: process.env.COGNITO_IDENTITY_POOL_ID,
    region: process.env.COGNITO_REGION,
    userPoolId: process.env.COGNITO_USER_POOL_ID,
    userPoolWebClientId: process.env.COGNITO_CLIENT_ID,
  },
});

I also tried updating the AWS config with my Amplify admin user credentials but no luck

AWS.config.update({
  region: process.env.REGION,
  credentials: new AWS.Credentials({
    accessKeyId: amplifyKeyId,
    secretAccessKey: amplifyAccessKey
  }),
});

[jkeys-ecg-nmsu]

You need to use “USER_PASSWORD_AUTH” authentication type if you want the username and password to actually get sent over the wire. Amplify uses SRP by default.

[github-actions[bot]]

This issue has been automatically locked since there hasn’t been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels or Discussions for those types of questions.