arn:aws:iam::aws:policy/AdministratorAccess-Amplify needs cognito-idp:ListIdentityProviders when using "amplify import auth" and continuous deployment

[jeffie9]

Before opening, please confirm:

• I have checked to see if my question is addressed in the FAQ.
• I have searched for duplicate or closed issues.
• I have read the guide for submitting bug reports.
• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

App Id

No response

Region

No response

Amplify Console feature

Backend builds

Describe the bug

Build raises exception:
User: arn:aws:sts::123456789:assumed-role/amplifyconsole-backend-role/BuildSession is not authorized to perform: cognito-idp:ListIdentityProviders on resource: arn:aws:cognito-idp:us-east-1:123456789:userpool/us-east-1_XYZABC because no identity-based policy allows the cognito-idp:ListIdentityProviders action

Expected behavior

Should be able to connect repository and have first build get as far as running the framework build command (eg. npm run script build). Code build failures would be excused, but never makes it that far.

Reproduction steps

1. Create app and add to amplify: amplify init
2. Create or find existing Cognito Identity Pool and User Pool: amplify import auth
3. Connect repository (eg. GitHub): amplify add hosting
   This requires to use or create role. Create new role using selected defaults (Amplify, arn:aws:iam::aws:policy/AdministratorAccess-Amplify)
4. Build or rebuild app: Exception!

Build Settings

Using default generated amplify.yml

Additional information

As a workaround, add cognito-idp:ListIdentityProviders as inline policy to service role (eg. amplifyconsole-backend-role).

[github-actions]

Hi 👋, thanks for opening! While we look into this...

If this issue is related to custom domains, be sure to check the custom domains troubleshooting guide to see if that helps. Also, there is a more general troubleshooting FAQ that may be helpful for other questions.

Lastly, please make sure you've specified the App ID and Region in the issue!

[jeffie9]

Still need to add environment variables as mentioned in #1271

[jeffie9]

After adding an frontend environment, I had to add this permission too: cognito-idp:GetUserPoolMfaConfig

[ghost]

Hi Jeff👋🏽 , thanks for raising this and for providing the reproduction steps. We will try to reproduce the behavior and I'll update once I have more information.