I am creating Cognito User Pool, User Pool client and domain with terraform.
If there is a update to cognito user pool (e.g. attributes), terraform needs to destroy and re-create the three resources, however terraform apply fails with error during destroy of aws_cognito_user_pool_domain:
InvalidParameter: 1 validation error(s) found.
- minimum field size of 1, DeleteUserPoolDomainInput.UserPoolId.
Terraform version: 0.11.11
aws provider version: 1.52.0
I have tried manually deleting the domain and running terraform plan/apply but then it fails with 'InvalidParameterException: No such domain or user pool exists.'
resource "aws_cognito_user_pool" "admin_cognito_pool" {
name = "dev-admin-pool"
alias_attributes = ["email"]
auto_verified_attributes = ["email"]
admin_create_user_config = {
allow_admin_create_user_only = true
}
}
resource "aws_cognito_user_pool_client" "admin_cognito_pool_client" {
name = "dev-admin-pool-client"
user_pool_id = "${aws_cognito_user_pool.admin_cognito_pool.id}"
generate_secret = false
...
}
resource "aws_cognito_user_pool_domain" "admin_cognito_domain" {
domain = "demo-dev"
user_pool_id = "${aws_cognito_user_pool.admin_cognito_pool.id}"
}
Above code will create user pool, user pool client, user pool domain successfully.
Next, modify aws_cognito_user_pool in the above code and run terraform plan/apply
resource "aws_cognito_user_pool" "admin_cognito_pool" {
name = "dev-admin-pool"
alias_attributes = ["email"]
auto_verified_attributes = ["email"]
admin_create_user_config = {
allow_admin_create_user_only = true
}
schema = [
{
attribute_data_type = "String",
name = "family_name",
required = true,
mutable = true,
string_attribute_constraints {
min_length = 6
max_length = 32
}
},
]
}
Terraform plan:
-/+ module.aws-383.aws_cognito_user_pool.admin_cognito_pool (new resource required)
id: "ap-southeast-2_CFPLxLl5A" => <computed> (forces new resource)
admin_create_user_config.#: "1" => "1"
admin_create_user_config.0.allow_admin_create_user_only: "true" => "true"
admin_create_user_config.0.unused_account_validity_days: "7" => "7"
alias_attributes.#: "" => "1" (forces new resource)
alias_attributes.881205744: "" => "email" (forces new resource)
arn: "arn:aws:cognito-idp:ap-southeast-2:xxxxxxxx:userpool/ap-southeast-2_CFPLxLl5A" => <computed>
auto_verified_attributes.#: "1" => "1"
auto_verified_attributes.881205744: "email" => "email"
creation_date: "2018-12-19T04:49:06Z" => <computed>
email_verification_message: "" => <computed>
email_verification_subject: "" => <computed>
endpoint: "cognito-idp.ap-southeast-2.amazonaws.com/ap-southeast-2_CFPLxLl5A" => <computed>
lambda_config.#: "0" => <computed>
last_modified_date: "2018-12-19T04:49:06Z" => <computed>
mfa_configuration: "OFF" => "OFF"
name: "dev-admin-pool" => "dev-admin-pool"
password_policy.#: "1" => <computed>
schema.#: "0" => "1" (forces new resource)
schema.893014206.attribute_data_type: "" => "String" (forces new resource)
schema.893014206.developer_only_attribute: "" => ""
schema.893014206.mutable: "" => "true" (forces new resource)
schema.893014206.name: "" => "family_name" (forces new resource)
schema.893014206.number_attribute_constraints.#: "" => "0"
schema.893014206.required: "" => "true" (forces new resource)
schema.893014206.string_attribute_constraints.#: "" => "0"
verification_message_template.#: "1" => <computed>
-/+ module.aws-383.aws_cognito_user_pool_client.admin_cognito_pool_client (new resource required)
id: "2tsed339bl6ds4437n1h0hasr4" => <computed> (forces new resource)
allowed_oauth_flows.#: "2" => "2"
allowed_oauth_flows.2645166319: "code" => "code"
allowed_oauth_flows.3465961881: "implicit" => "implicit"
allowed_oauth_flows_user_pool_client: "true" => "true"
allowed_oauth_scopes.#: "2" => "2"
allowed_oauth_scopes.2517049750: "openid" => "openid"
allowed_oauth_scopes.881205744: "email" => "email"
callback_urls.#: "1" => "1"
callback_urls.0: "https://qnq2ds22xg.execute-api.ap-southeast-2.amazonaws.com/staging/admin-portal/redirectUrl/" => "https://qnq2ds22xg.execute-api.ap-southeast-2.amazonaws.com/staging/admin-portal/redirectUrl/"
client_secret: "" => <computed>
explicit_auth_flows.#: "2" => "2"
explicit_auth_flows.1860959087: "USER_PASSWORD_AUTH" => "USER_PASSWORD_AUTH"
explicit_auth_flows.245201344: "ADMIN_NO_SRP_AUTH" => "ADMIN_NO_SRP_AUTH"
generate_secret: "false" => "false"
name: "dev-admin-pool-client" => "dev-admin-pool-client"
refresh_token_validity: "30" => "30"
supported_identity_providers.#: "1" => "1"
supported_identity_providers.0: "COGNITO" => "COGNITO"
user_pool_id: "ap-southeast-2_CFPLxLl5A" => "${aws_cognito_user_pool.admin_cognito_pool.id}" (forces new resource)
-/+ module.aws-383.aws_cognito_user_pool_domain.admin_cognito_domain (new resource required)
id: "demo-dev" => <computed> (forces new resource)
aws_account_id: "" => <computed>
cloudfront_distribution_arn: "" => <computed>
domain: "demo-dev" => "demo-dev"
s3_bucket: "" => <computed>
user_pool_id: "" => "${aws_cognito_user_pool.admin_cognito_pool.id}" (forces new resource)
version: "" => <computed>
Exact error with terraform apply -
[...]
module.aws-383.aws_cognito_user_pool_client.admin_cognito_pool_client: Destroying... (ID: 2tsed339bl6ds4437n1h0hasr4)
module.aws-383.aws_cognito_user_pool_domain.admin_cognito_domain: Destroying... (ID: demo-dev)
module.aws-383.aws_cognito_user_pool_client.admin_cognito_pool_client: Destruction complete after 0s
Error: Error applying plan:
1 error(s) occurred:
* module.aws-383.aws_cognito_user_pool_domain.admin_cognito_domain (destroy): 1 error(s) occurred:
* aws_cognito_user_pool_domain.admin_cognito_domain: InvalidParameter: 1 validation error(s) found.
- minimum field size of 1, DeleteUserPoolDomainInput.UserPoolId.
Terraform should be able to destroy cognito user pool domain which will allow the resources to be re-created.