Transform fails when DeletionProtection specified in AWS::Cognito::UserPool with Cognito event

[jjaimez]

Describe your idea/feature/enhancement

I wish the SAM Translator would support DeletionProtection in Cognito User Pool definition.

Proposal

MyUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      DeletionProtection: ACTIVE

Things to consider:

Additional Details

I tried to do it and i got the following error.
property DeletionProtection not defined for resource of type AWS::cognito::UserPool

[xazhao]

Thanks for the feature request. I will discuss this with the team and post updates here.

[ssenchenko]

DeletionProtection seems to be quite a fresh feature. The blog which mentions it, is dated of Oct 2022.
It explains why DeletionProtection is not currently supported by CloudFormation https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html#cfn-cognito-userpool-deletionprotection
We can add it after CloudFormation starts supporting it.

[ssenchenko]

Feel free to reopen this issue if you notice that CloudFormation has started to support this property

[benconnito]

still seeing the error when adding the DeletionProtection to a user pool

Transform AWS::Serverless-2016-10-31 failed with: Invalid Serverless Application Specification document. Number of errors found: 1. Resource with id [AuthUserPool] is invalid. property DeletionProtection not defined for resource of type AWS::Cognito::UserPool

[JP-tech-sh]

I'm using SAM CLI to version 1.76.0, I identified that according to Cloud formation docs this feature should be supported. However, if you don't use the Ref build in cloud formation function to refer to the cognito user pool anywhere in the template, it'll work fine. Surprisingly, if you add at least one instance of Ref to a cognito user pool with DeletionProtection enabled, it will show this error. In my case, I'm using cognito events on lambda resources that need a reference to a cognito user pool in the template. If using this particular configuration, it will fail with the error mentioned above. I guess is a very similar use case for the other devs reporting this issue. Please let me know if I can provide additional details or if you recommend that I open a separated issue for this. As a temporary solution, I removed the DeletionProtection from my user pool, but this is risky on a production scenario.

[hoffa]

@jjaimez @benconnito Could you clarify what the ask is?

AWS::Cognito::UserPool supports DeletionProtection:

Transform: AWS::Serverless-2016-10-31
Parameters:
  DeletionProtection:
    Type: String
    Default: ACTIVE
Resources:
  MyUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      DeletionProtection: !Ref DeletionProtection

Deploy:

sam deploy --region us-west-2 --resolve-s3 --capabilities CAPABILITY_IAM --stack-name test-deletion-protection --template template.yaml

[hoffa]

@JP-tech-sh Would you be able to provide a template reproducing the issue?

[JP-tech-sh]

@hoffa Yes, I'll provide a minimal working template reproducing the issue, so you can test it. I'll try to have it ready for today.

[benconnito]

i am actually unable to get NEW cognito domains (wether initially inactive or active) to have the issue. however updating an existing cognito domain (created BEFORE the deletion protection feature) to have deletion protection seems to fail

all i added to my existing cognito resource in cloudformation was

DeletionProtection: !If [IsProd, 'ACTIVE', 'INACTIVE']

and its actually failing for our staging cognito to update it to INACTIVE (it is not active atm)

[JP-tech-sh]

Hello, this is the example sam project showing the error, sorry about the delay. https://github.com/JP-tech-sh/deletion-protection-sam-error
To run the project.
sam build --beta-features --cached
sam deploy --guided

[hoffa]

Hello, this is the example sam project showing the error, sorry about the delay. https://github.com/JP-tech-sh/deletion-protection-sam-error To run the project. sam build --beta-features --cached sam deploy --guided

Thanks a lot for this, I was able to reproduce.

Here's a minimal example. Save as template.yaml:

Transform: AWS::Serverless-2016-10-31
Resources:
  MyUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      DeletionProtection: ACTIVE

  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Runtime: python3.8
      InlineCode: foo
      Handler: bar
      Events:
        CognitoEvent:
          Type: Cognito
          Properties:
            Trigger: CustomMessage
            UserPool: !Ref MyUserPool

Creating the change set will fail with:

Transform AWS::Serverless-2016-10-31 failed with: Invalid Serverless Application Specification document. Number of errors found: 1. Resource with id [MyUserPool] is invalid. property DeletionProtection not defined for resource of type AWS::Cognito::UserPool

If you remove the Cognito event, it succeeds:

Transform: AWS::Serverless-2016-10-31
Resources:
  MyUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      DeletionProtection: ACTIVE

  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Runtime: python3.8
      InlineCode: foo
      Handler: bar

[hoffa]

I've created a fix for this in #3041. I'll also look into a more longer-term fix so these issues don't occur for every new property.

[hoffa]

I'll close this since #3041 is merged; it'll roll out over the coming weeks. I've opened #3042 for the longer-term issue.