Executing `import amplify auth` for `Cognito User Pool and Identity Pool` and passing on the `Web Client` as well as the `Native client` fails

Ran into this issue as well. The Amplify Auth import docs mention the following:

Your Identity Pool needs:

• an Authenticated Role with a trust relationship to your Identity Pool
• an optional Unauthenticated Role if you want to use any guest user access for your Amplify categories. (Example: Guest access for your S3 buckets or REST API endpoints)

However, I:

• Using an identity pool with an "authenticated" role with proper trust relationship intact (role, policy, identity pool role attachment).
• Made sure the IAM role I was using to deploy this change had proper permissions to list and read identity pools & roles.

Still no help.

I then enabled "Allow unauthenticated identities" (although I did not want this) and things worked smoothly. This is because this setting will automatically generate two authenticated and unauthenticated roles and attach them for you.

However, as I did not want unauthenticated identity access, I disabled that again. Based off that setting working, I wondered if that Unauthenticated Role was truly optional, well it turns out it's not. At least not in the latest Amplify system. Someone must have changed this behaviour without updating the docs.

Solution:

Your Identity Pool needs:

• an Authenticated Role with a trust relationship to your Identity Pool
• an Unauthenticated Role with a trust relationship to your Identity Pool

To check if your identity pool is set up properly run this function in the AWS CLI:

aws cognito-identity get-identity-pool-roles --identity-pool-id "your identity pool id here"

You should get something like this:

{
   "IdentityPoolId": "your identity pool id here",
   "Roles": {
      "authenticated": "your authenticated role ARN here"
      "unauthenticated": "your authenticated role ARN here"
   }
}