fix(gen2-migration): skip Identity Pool when Gen1 auth is User Pool-only - #14971
Conversation
e1fe2d6 to
39ddc83
Compare
CI Failure NoteThe Root causeGitHub Actions recently deprecated Node 20 on runners and forces all actions to run under Node 24. Under Node 24, Jest's process exit behavior is stricter with open async handles — specifically All What this PR includes to mitigate
What remains (out of scope for this PR)The Node 24 runner upgrade requires either:
This blocks all PRs to this repo equally and should be tracked as a separate infrastructure issue. |
743ee9c to
8b529dd
Compare
When a Gen1 project is configured with 'User Sign-Up & Sign-In only' (no Identity Pool), the migration tool now correctly omits Identity Pool escape hatches and cognitoIdentityProviders registration from the generated code. Previously, the generator unconditionally fetched IdentityPoolId from amplify-meta.json (throwing if absent) and always emitted Identity Pool references in applyEscapeHatches(). This caused User Pool-only setups to gain an unwanted Identity Pool, changing the auth architecture from JWT-based to IAM-based. Changes: - Add Gen1App.tryResourceMetaOutput() for optional output keys - Make IdentityPoolId lookup non-throwing via tryResourceMetaOutput - Skip fetchIdentityPool when no IdentityPoolId is present - Guard cfnIdentityPool escape hatches on identityPool presence - Skip cognitoProvidersPushStatements when no Identity Pool exists - Add regression test for User Pool-only configuration - Fix SpinningLogger to register SIGINT handler once (singleton pattern) instead of per-instance, preventing MaxListenersExceededWarning and allowing clean process exit under Node 24 Closes #14742
8b529dd to
cc79b34
Compare
… Pool fix - Remove --forceExit from test script; real handle leak resolved by SpinningLogger singleton + MockClients cleanup (full suite exits clean) - Dedup resourceMetaOutput by delegating _meta traversal to tryResourceMetaOutput - SpinningLogger unregisters from instances on spinner deactivation so the set only holds active spinners instead of growing unbounded
|
The destination branch should be |
Problem
When migrating a Gen1 Amplify project to Gen2 using
amplify gen2-migration generate, the migration tool creates Identity Pool configuration even when the Gen1 project was configured with "User Sign-Up & Sign-In only" — which provisions only a Cognito User Pool with no Identity Pool dependency.This changes the auth architecture from JWT-based (User Pool authorizer) to IAM-based (which requires an Identity Pool), creates orphaned IAM roles, and breaks
ampx generate outputsif the Identity Pool is later removed via CDK escape hatches.Closes #14742
Root Cause
auth.generator.tsunconditionally calledthis.gen1App.resourceMetaOutput(this.resource, 'IdentityPoolId')which throws if the key is absent. Even when present (Gen1 always creates an Identity Pool), the renderer emitted Identity Pool escape-hatch code without checking whether the pool was actually in use.Changes
gen1-app.ts: AddtryResourceMetaOutput()— a non-throwing variant that returnsundefinedfor absent output keysauth.generator.ts: UsetryResourceMetaOutputforIdentityPoolId; skipfetchIdentityPoolwhen absentauth.renderer.ts: Guard all Identity Pool escape hatches (cfnIdentityPool,cognitoIdentityProviderspush,addPropertyDeletionOverride) on!!options.identityPoolauth.generator.test.ts: Add regression test for User Pool-only configuration (noIdentityPoolIdin output)Testing
generates auth without Identity Pool when IdentityPoolId is absentfetchIdentityPoolis never calledcfnIdentityPool,cognitoIdentityProviders, orcognitoProvidersreferencesIdentityPoolIdin their meta)