[Bug]: Cognito client pinpoint analytics integration always creates it for us-east-1 region.

[ivan-kiselev]

Terraform Core Version

1.6.*

AWS Provider Version

5.0.*

Affected Resource(s)

AWS Cognito client integration with pinpoint, e.g. this block here.

Expected Behavior

One either given a choice in which region to integrate with pinpoint, or the software derives the right one indirectly from available data. I guess, since recent times there are options in between what cognito regions can do analytics in what pinpoint regions, according to official documentation, but terraform always defaults to us-east-1

Actual Behavior

At the moment, my user pool is in eu-central-1 and the pinpoint app is also in eu-central-1, but having the following config:

resource "aws_cognito_user_pool_client" "web" {
...
  analytics_configuration {
    application_id   = aws_pinpoint_app.general_user.application_id
    role_arn         = aws_iam_role.user_pool_client_pinpoint.arn
    external_id      = "something"
    user_data_shared = true
  }
}

results in the following effect (pay attention to the region):

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

resource "aws_cognito_user_pool" "pool" {
name = "test"
}

resource "aws_cognito_user_pool_client" "web" {
  name                          = "web"
  user_pool_id                  = aws_cognito_user_pool.pool.id
  analytics_configuration {
    application_id   = aws_pinpoint_app.testapplication_id
    role_arn         = aws_iam_role.user_pool_client_pinpoint.arn
    external_id      = "web-app"
    user_data_shared = true
  }
}

resource "aws_pinpoint_app" "test" {
  name = "test"
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["cognito-idp.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "user_pool_client_pinpoint" {
  name               = "userPoolClientPinpoint"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

Steps to Reproduce

Just deploy the code with AWS provide in eu-central-1 region

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

Relevant doc: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-pinpoint-integration.html

Would you like to implement a fix?

None

[github-actions[bot]]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[ivan-kiselev]

The behavior is not observed with the following configuration:

...
  analytics_configuration {
    application_arn  = aws_pinpoint_app.general_user.arn
    user_data_shared = true
  }
...

E.g. shall one configure analytics config directly through ARN instead of application ID, the region is picked up correctly.

I've checked corresponding API endpoint and terraform code, and how the UI sends the request to the Cognito and it honestly feels like a bug on AWS Backend sinde rather than terraform.

[ivan-kiselev]

Closing due to inactivity.

[github-actions[bot]]

[!WARNING] This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.