Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

@aws-cdk/aws-cognito-identitypool-alpha: allowUnauthenticatedIdentities still creates IAM role #25470

Closed
markmansur opened this issue May 7, 2023 · 7 comments
Closed

@aws-cdk/aws-cognito-identitypool-alpha: allowUnauthenticatedIdentities still creates IAM role #25470

markmansur opened this issue May 7, 2023 · 7 comments
Assignees
@TheRealAmazonKendra
Labels
@aws-cdk/aws-cognito-identitypool bug This issue is a bug. effort/small Small work item – less than a day of effort in-progress This issue is being actively worked on. p2

Comments

@markmansur
Copy link
Contributor

Describe the bug

Hello!

When creating an IdentityPool that I only want authenticated users to access I set allowUnauthenticatedIdentities to false. However, this still ends up creating an IAM role for unauthenticated users, eventhough I specified I don't need it and it's not required.

Expected Behavior

When setting allowUnauthenticatedIdentities to false, an IAM role for unauthenticated users should not be synthesized.

Current Behavior

When setting allowUnauthenticatedIdentities to false, an IAM role for unauthenticated users is being synthesized.

Reproduction Steps

const stack = new Stack();
const identityPool = new IdentityPool(stack, 'TestIdentityPool');

Possible Solution

Check if allowUnauthenticatedIdentities is false. If so, do not synthesize the unauthenticated IAM role.

Additional Information/Context

No response

CDK CLI Version

2.78.0

Framework Version

No response

Node.js Version

16.16.0

OS

MacOS

Language

Typescript

Language Version

No response

Other information

No response
@markmansur markmansur added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels May 7, 2023
@pahud
Copy link
Contributor

pahud commented May 8, 2023

Yes I believe we should fix this:

aws-cdk/packages/@aws-cdk/aws-cognito-identitypool-alpha/lib/identitypool.ts

Line 433 in b76c182

this.unauthenticatedRole = props.unauthenticatedRole ? props.unauthenticatedRole : this.configureDefaultRole('Unauthenticated');

Are you interested to submit a PR for that?

@pahud pahud added p2 effort/small Small work item – less than a day of effort and removed needs-triage This issue or PR still needs to be triaged. labels May 8, 2023
@markmansur
Copy link
Contributor Author

Yeah I'll submit a PR

@TheRealAmazonKendra TheRealAmazonKendra self-assigned this May 8, 2023
@TheRealAmazonKendra
Copy link
Contributor

A redesign of this is in progress.

@TheRealAmazonKendra TheRealAmazonKendra added the in-progress This issue is being actively worked on. label May 8, 2023
@markmansur
Copy link
Contributor Author

Okay, I'll wait for that. Is there a tracking issue?

@markmansur
Copy link
Contributor Author

#25204?

@evgenyka evgenyka mentioned this issue Oct 10, 2023
Open
@Tietew Tietew mentioned this issue Jul 18, 2024
Closed
1 task
@Leo10Gama
Copy link
Member

This is the the expected behaviour of IdentityPools. When allowUnauthenticatedIdentities is set to false, it will still create the unauthenticated role, but more importantly, it sets "Guest Status" to inactive in the console, which is what the parameter is meant to do. Even as shown in the console, it's possible to both have a guest role and have guest access disabled, so there is no reason to change this behaviour.

@github-actions GitHub Actions
Copy link

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Aug 29, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@TheRealAmazonKendra TheRealAmazonKendra

Labels
@aws-cdk/aws-cognito-identitypool bug This issue is a bug. effort/small Small work item – less than a day of effort in-progress This issue is being actively worked on. p2
Projects
None yet
Milestone
No milestone
4 participants
@pahud @markmansur @Leo10Gama @TheRealAmazonKendra