(aws-cognito): UserPool constructor adds an incorrect Lambda permission #19604
Description
What is the problem?
When I specify lambdaTriggers in UserPool, the function's lambda permission should have a SourceArn condition with the UserPool's ARN.
But UserPool constructor adds a lambda permisson without SourceArn condition.
UserPool.addTrigger method adds a correct permission with SourceArn.
This seems to be caused that the constructor code calls addLambdaPermission before assigning this.userPoolArn.
Reproduction Steps
const handler = new lambda.Function(this, 'Handler', { ... });
new cognito.UserPool(this, 'UserPool', {
lambdaTriggers: {
postConfirmation: handler,
},
...
});What did you expect to happen?
Following Lambda::Permission resource is created:
"HandlerPostConfirmationCognitoXXXXXXXX": {
"Type": "AWS::Lambda::Permission",
"Properties": {
"Action": "lambda:InvokeFunction",
"FunctionName": {
"Fn::GetAtt": [
"HandlerXXXXXXXX",
"Arn"
]
},
"Principal": "cognito-idp.amazonaws.com",
"SourceArn": {
"Fn::GetAtt": [
"UserPoolXXXXXXXX",
"Arn"
]
}
},
"Metadata": {
"aws:cdk:path": "..."
}
},What actually happened?
Following Lambda::Permission resource was created:
"HandlerPostConfirmationCognitoXXXXXXXX": {
"Type": "AWS::Lambda::Permission",
"Properties": {
"Action": "lambda:InvokeFunction",
"FunctionName": {
"Fn::GetAtt": [
"HandlerXXXXXXXX",
"Arn"
]
},
"Principal": "cognito-idp.amazonaws.com"
},
"Metadata": {
"aws:cdk:path": "..."
}
},CDK CLI Version
2.18.0
Framework Version
No response
Node.js Version
14.19.0
OS
Linux
Language
Typescript
Language Version
No response
Other information
No response