(cognito): CfnIdentityPoolRoleAttachment with rolemappings seems impossible...

The roleMappings property requires that you use identity provider as a key, however if you try to do:

const identityProviderUrl : string = `cognito-idp.us-east-1.amazonaws.com/${this.userPool.userPoolId}:${this.userPoolClient.userPoolClientId}`;

You get:

throw new Error(`"${key}" is used as the key in a map so must resolve to a string, but it resolves to: ${JSON.stringify(resolvedKey)}. Consider using "CfnJson" to delay resolution to deployment-time`);

Is there any workaround to this that doesn’t require hard coding it as a property / multiple deploys to bootstrap?

Reproduction Steps

    const identityProviderUrl : string = `cognito-idp.us-east-1.amazonaws.com/${this.userPool.userPoolId}:${this.userPoolClient.userPoolClientId}`;

    const roleMapping : cognito.CfnIdentityPoolRoleAttachment.RoleMappingProperty = {
      identityProvider: identityProviderUrl,
      ambiguousRoleResolution: "Deny",
      type: "Rules",
      rulesConfiguration: {
        rules: [{
          claim: "cognito:groups",
          matchType: "Contains",
          value: "xxxxxxxx",
          roleArn: this.authenticatedRole.roleArn
        }]
      }
    }

    new cognito.CfnIdentityPoolRoleAttachment(this as any, "IdentityPoolRoleAttachment", {
        identityPoolId: this.identityPool.ref,
        roles: {},
        roleMappings: {
          [identityProviderUrl]: roleMapping   // <---- Problem occurs here...
        }
    });

This is 🐛 Bug Report

[juanpujol]

Having the same issue, can’t resolve the right role mapping for Cognito.

hrow new Error(`"${String(key)}" is used as the key in a map so must resolve to a string, but it resolves to: ${JSON.stringify(resolvedKey)}. Consider using "CfnJson" to delay resolution to deployment-time`);
              ^
Error: Resolution error: Resolution error: "${Token[TOKEN.123]}" is used as the key in a map so must resolve to a string, but it resolves to: {"Fn::Join":["",["\"cognito-idp.us-east-1.amazonaws.com/",{"Ref":"UserPool6BA7E5F2"},":",{"Ref":"UserPoolClient2F5918F7"},"\""]]}. Consider using "CfnJson" to delay resolution to deployment-time..

[FelipeSantosTrilogy]

There’s a simpler solution by using the literal "cognito-user-pool" as the key for the role mapping.

const roleAttachment = new cognito.CfnIdentityPoolRoleAttachment(this, 'role-attachment', {
      identityPoolId: this.identityPool.ref,
      roles: {},
      roleMappings:{
        "cognito-user-pool": roleMapping
      },
    });