(aws-appsync): userPoolConfig authorizer ignores the userpool region

When adding an authorizer to the appSync, using the userPoolConfig, we can import the authorizer from the Arn, however the the CF will add the deployment region rather than the authorizer region for that particular instance.

Reproduction Steps

    const currentAuthorizer = cognito.UserPool.fromUserPoolArn(this, 'AuthInAnotherRegion', userPoolArn);
    const featuresApi = new appsync.GraphqlApi(this, 'GqlApi', {
      name: 'feature-control',
      schema: appsync.Schema.fromAsset('graphql/schema.graphql'),
      authorizationConfig: {
        defaultAuthorization: {
          authorizationType: appsync.AuthorizationType.USER_POOL,
          userPoolConfig: {
            userPool: currentAuthorizer,
          },
        },
    });

What did you expect to happen?

Resources:
  GqlApi4E487465:
    Type: AWS::AppSync::GraphQLApi
    Properties:
      AuthenticationType: AMAZON_COGNITO_USER_POOLS
      Name: feature-control
      UserPoolConfig:
        AwsRegion: eu-west-2
        DefaultAction: ALLOW
        UserPoolId: eu-west-2_USERPOOLID
    Metadata:
      aws:cdk:path: FeaturesBackendFrankFurt/GqlApi/Resource

What actually happened?

Resources:
  GqlApi4E487465:
    Type: AWS::AppSync::GraphQLApi
    Properties:
      AuthenticationType: AMAZON_COGNITO_USER_POOLS
      Name: feature-control
      UserPoolConfig:
        AwsRegion: eu-central-1
        DefaultAction: ALLOW
        UserPoolId: eu-west-2_USERPOOLID
    Metadata:
      aws:cdk:path: FeaturesBackendFrankFurt/GqlApi/Resource

Environment

• CDK CLI Version : 1.94.1
• Framework Version:
• Node.js Version: 14.16.0
• OS : macOS Darwin
• Language (Version): typescript

Other

I have tried overwriting the env to see if that would be picked up as a workaround to no avail:

defaultAuthorization: {
          authorizationType: appsync.AuthorizationType.USER_POOL,
          userPoolConfig: {
            userPool: currentAuthorizer,
          },
        },

I expect the region to be picked up based on the retuned authorizer. As it most likely will include its own region (or picked up from the id as it is also included…)

---

This is 🐛 Bug Report

Thanks!

[DaWyz]

The issue is related to the way the Cognito UserPools are imported. You won’t be able to parse the value from the arn as it’s recreated on import. Created a PR to fix the issue.

[psoares-resilient]

Found a workaround (not sure if it is intended to be used this way… ).

The code will set the region based on the userPoll.stack.region, by passing a new Stack and setting the region I wan as props, it will pick up the right region. It does look a but hacky, but it works:

    const currentAuthorizer = cognito.UserPool.fromUserPoolArn(
      new Stack(this, 'ImportCognitoFromAnotherRegion', {
        env: {
          region: 'eu-west-2',
        },
      }),
      'TheCognitoFromAnotherRegion',
      userPoolArn
    );