Closed rjd1 closed 3 years ago
Hi @rjd1 -
It appears that you're attempting to use the user pool's name
as the value for this parameter instead of the pool's Id
, which is separate. To find a user pool's ID, you can use the AWS Console:
The Pool Id
is what needs to be supplied as a parameter to the CloudFormation template.
Apologies for the confusion. I've made a note to be more clear about this in the parameter description and our documentation.
Thank you
Hi @ericquinones,
Thanks for the response and clarification, not sure how I was getting those two mixed up.
I'm hitting another issue that appears to be permissions related. This is happening with the solution as built following the instructions in this project as well as a separate attempt just with the template version straight from the AWS Solutions documentation (that uses aws pre-configured buckets)...
2021-04-08T02:13:47.870Z 49c7548b-1b31-4dfe-a9e3-32f5cd4366e9 INFO List Operation Results Response: {
"ResponseMetadata": {
"RequestId": "b9f5097a-9837-4da7-b334-d6965e89a956"
},
"Summaries": [
{
"Account": "[accound-id]",
"Region": "us-east-1",
"Status": "PENDING",
"OrganizationalUnitId": ""
},
{
"Account": "[accound-id]",
"Region": "us-west-2",
"Status": "RUNNING",
"StatusReason": "The following resource(s) failed to create: [NotificationTopic, CognitoUserImportCloudWatchLogsRole, ImportNewUsersDeadLetterQueue, ImportCheckNewUserPoolLambdaRole, CheckExecutionsLambdaRole, UserImportJobMappingFilesLogsBucket]. Delete requested by user.",
"AccountGateResult": {
"Status": "SKIPPED",
"StatusReason": "Insufficient permissions to invoke AWSCloudFormationStackSetAccountGate"
},
"OrganizationalUnitId": ""
}
]
}
2021-04-08T02:15:31.244Z c31fc5cb-57e5-4178-b462-aef291765a78 INFO List Operation Results Response:
{
"ResponseMetadata": {
"RequestId": "bf2173df-9529-4d98-b095-108389601e2c"
},
"Summaries": [
{
"Account": "[accound-id]",
"Region": "us-west-2",
"Status": "SUCCEEDED",
"AccountGateResult": {
"Status": "SKIPPED",
"StatusReason": "Insufficient permissions to invoke AWSCloudFormationStackSetAccountGate"
},
"OrganizationalUnitId": ""
},
{
"Account": "[accound-id]",
"Region": "us-east-1",
"Status": "SUCCEEDED",
"AccountGateResult": {
"Status": "SKIPPED",
"StatusReason": "CloudFormation stack not found"
},
"OrganizationalUnitId": ""
}
]
}
Any ideas on this?
Thank you, Ryan
Hi @rjd1 -
This seems like there might be a problem with the deployment of one of the StackSet instances and when it fails, it rolls back the entire deployment. When this solution is launched, your main CloudFormation template will begin deploying and then it will deploy a StackSet with one instance in each region.
To troubleshoot a bit more:
StackSet-
. Hey @ericquinones,
I only see deleted StackSet stacks in the secondary region. Following is the resource failure from the CF events there.
Logical ID | Status | Status reason
NotificationTopic | CREATE_FAILED | Invalid parameter: Attributes Reason: DisplayName (Service: AmazonSNS; Status Code: 400; Error Code: InvalidParameter; Request ID: 40d8b625-a850-5c7c-acb9-eecdc0a7a8f3; Proxy: null)
-- | -- | --
Thanks, Ryan
Hi @rjd1 -
I believe this is due to a known issue. The name of the CloudFormation stack used when the solution is launched is used to create the name of the SNS topic.
There’s a character limit for the topic Display Name but in cases where a long CloudFormation stack name is used, it puts us over that limit, hence the error.
Can you please try to launch the solution with a short CloudFormation stack name and see if that resolves it?
Thanks
Hi @ericquinones,
Looks like you're right about the issue, with a shorter name the stack created successfully. It'd definitely be good to have a warning about this in the documentation somewhere. Especially with the solution name being so long - I was actually just trying to use a shortened version of that originally for the stack (but obviously not shortened enough).
Really nice to finally get this to deploy properly. Thanks so much for your help!
Regards, Ryan
Hi @rjd1 -
Great, I'm glad you were able to deploy. Apologies for that issue with the stack name. This is something we'll be fixing the next time we update the solution.
Thanks
Fixed in version 1.0.1
Describe the bug It's possible to have a user pool in place with a name that is not accepted by this solution. This is because the permitted pattern of PrimaryUserPoolId is not consistent with the Cognito service requirement.
To Reproduce Through the AWS console or via CLI, it's possible to create, e.g., a pool named MY-POOL. Then if this is specified in the PrimaryUserPoolId parameter to cognito-user-profiles-export-reference-architecture.template it will cause an error.
Expected behavior The solution should accept a name with a dash in it and proceed with the CF stack create.
Please complete the following information about the solution:
To get the version of the solution, you can look at the description of the created CloudFormation stack. For example, "(SO0126) - Cognito User Profiles Export Reference Architecture. Version v1.0.0". If the description does not contain the version information, you can look at the mappings section of the template:
Screenshots N/A
Additional context The Cognito console and API documentation provide the regex name pattern as [\w\s+=,.@-]+
I also have an AWS Support case open on this (ID 8143657001), they suggested I create an Issue here.