AWS Events - Cognito User Pool Triggers fail to deploy

This is a Bug Report

Description

• What went wrong? I tried to deploy Cognito Triggers on 1.50.0. The error I’m getting related to PreSignUp: “is not authorized to perform: iam:PassRole on resource”. In 1.49.0 it deploys correctly however I need to include a UserMigration trigger and this is only available in 1.50.0. I am deploying with full Admin privileges.

• What did you expect should have happened? Deploy all

• What was the config you used?

functions:
  preSignUp:
    handler: handler.autoConfirmUser
    events:
      - cognitoUserPool:
          pool: ${self:provider.environment.COGNITO_POOL}
          trigger: PreSignUp
          existing: true
  migrateUser:
    handler: handler.migrateUser
    events:
      - cognitoUserPool:
          pool: ${self:provider.environment.COGNITO_POOL}
          trigger: UserMigration
          existing: true
  postConfirmation:
    handler: handler.addUserToGroup
    events:
      - cognitoUserPool:
          pool: ${self:provider.environment.COGNITO_POOL}
          trigger: PostConfirmation
          existing: true

• What stacktrace or error message from your provider did you see?

 
  An error occurred: PreSignUpCustomCognitoUserPool1 - Failed to create resource. User: arn:aws:sts::844180208621:assumed-role/ttw3-cognito-triggers-liv-IamRoleCustomResourcesLa-9S662UBZG46B/ttw3-cognito-triggers-live2-custom-resource-existing-cup is not authorized to perform: iam:PassRole on resource: arn:aws:iam::844180208621:role/ttw3c9c9ab1014_sns-role-live See details in CloudWatch Log: 2019/08/24/[$LATEST]8062f5ca32e947f6a06a0e36a5284457.

Similar or dependent issues:

https://forum.serverless.com/t/deploy-failed-when-existing-user-pool-triggered-function-is-removed/9135/2

Additional Data

• Serverless Framework Version you’re using: 1.50.0
• Operating System: MacOS
• Stack Trace:
• Provider Error messages:

Serverless: Packaging service...
Serverless: Excluding development dependencies...
Serverless: Installing dependencies for custom CloudFormation resources...
Serverless: Uploading CloudFormation file to S3...
Serverless: Uploading artifacts...
Serverless: Uploading service ttw3-cognito-triggers.zip file to S3 (58.28 MB)...
Serverless: Uploading custom CloudFormation resources...
Serverless: Validating template...
Serverless: Updating Stack...
Serverless: Checking Stack update progress...
............................................
Serverless: Operation failed!
Serverless: View the full error output: https://us-west-2.console.aws.amazon.com/cloudformation/home?region=us-west-2#/stack/detail?stackId=arn%3Aaws%3Acloudformation%3Aus-west-2%3A844180208621%3Astack%2Fttw3-cognito-triggers-live2%2Ff71c10f0-c6b6-11e9-994f-021a2c452506
 
  Serverless Error ---------------------------------------
 
  An error occurred: PreSignUpCustomCognitoUserPool1 - Failed to create resource. User: arn:aws:sts::844180208621:assumed-role/ttw3-cognito-triggers-liv-IamRoleCustomResourcesLa-9S662UBZG46B/ttw3-cognito-triggers-live2-custom-resource-existing-cup is not authorized to perform: iam:PassRole on resource: arn:aws:iam::844180208621:role/ttw3c9c9ab1014_sns-role-live See details in CloudWatch Log: 2019/08/24/[$LATEST]8062f5ca32e947f6a06a0e36a5284457.
 
  Get Support --------------------------------------------
     Docs:          docs.serverless.com
     Bugs:          github.com/serverless/serverless/issues
     Issues:        forum.serverless.com
 
  Your Environment Information ---------------------------
     Operating System:          darwin
     Node Version:              10.15.3
     Framework Version:         1.50.0
     Plugin Version:            1.3.8
     SDK Version:               2.1.0

[DavidWells]

⊂◉‿◉つ I just ran into this as well. When removing the stack:

 Serverless Error ---------------------------------------

  An error occurred: UserMigrationCustomCognitoUserPool1 - The specified key does not exist. (Service: Amazon S3; Status Code: 404; Error Code: NoSuchKey; Request ID: FB8708D3526BEC46).

  Your Environment Information ---------------------------
     Operating System:          darwin
     Node Version:              10.4.1
     Framework Version:         1.67.0
     Plugin Version:            3.5.0
     SDK Version:               2.3.0
     Components Version:        2.22.3

I had the manually delete the stack and re-deploy.

It also seems like there *might be a race condition with the creation of these custom resources & when the permissions get attached to the lambda functions with cognitoUserPool triggers.

Aside, the reason I was removing the deploy was an error from PreSignUp trigger when using my login form. It was returning a UnexpectedLambdaException error something about the cognito not having permissions to invoke the presignup function.

After re-deploying the stack, everything works no lambda permission issue. I might try to use dependsOn if I see it again.

[zacharywenner]

Thanks!!! Perfect.