RFC: Use existing auth resources with referenceAuth

[josefaidt]

Hey folks 👋 we’re looking to introduce a mechanism to consume existing auth resources, and use with other Amplify resources like Data without additional configuration or the need for patching with CDK. This mechanism aims to address the following use cases:

• using existing auth resources with Data without CDK
• using existing auth resources with Storage without CDK
• using existing auth resources built and maintained by other teams
• enterprise microsites with a centralized auth resource

Similar to the define* terminology, we are looking to introduce reference* terminology in an effort to convey which resources are defined and managed by the Amplify app, and resources that are simply referenced to use with other Amplify resources. Unlike defined resources, referenced resources cannot be modified. For example, when referencing existing auth resources you will not be able to add additional identity providers unique to your app, or add additional/custom attributes to the user pool schema.

// amplify/auth/resource.ts
import { referenceAuth } from "@aws-amplify/backend"

export const auth = referenceAuth({
  userPoolId: "...",
  userPoolClientId: "...",
  identityPoolId: "...",
  authenticatedRoleName: "...",
  unauthenticatedRoleName: "...",
})

At a high level the following constraints exist with referenceAuth:

• auth resources cannot be modified
• defineAuth and referenceAuth cannot coexist in the same backend
• only one auth resource can be referenced
• groups can be used to define auth rules in Data, but are not exposed on backend.auth.resources

The props shape may change, but we’re curious to hear your thoughts and whether this addresses your use case!

[pfj3]

This would be a huge help!

[asmajlovicmars]

This would be essential for us to migrate a large Gen 1 application to Gen 2. The idea is to keep the existing authentication, rebuild the data models, and eventually migrate everything else from CDK to Amplify. It's also important to mention that we want to use referenced authentication for data authorization on both new and existing data models; otherwise, there's no point in having a referenced Cognito Pool.

[taoatmars]

I been trying to follow the documentation to connect to our existing Auth and wonder why it doesn't work with other resources. looks like this is the solution for it.

[caioquirino]

Hi @taoatmars although this looks acceptable, the other generated Metadata and resources does not recognize the configured auth, so as soon as you start integrating your data modeling with auth, you will start getting errors related to some Metadata that should be available but for some reason it is not.

It would be great also to be able to configure the project to reuse a single cognito user pool across all branches and sandboxes.

[taoatmars]

@caioquirino This is great insight, and thank you for stopping me diving into some rabbit hole. This has made it very difficult for us to migrate from amplify v1 to v2.

[luunminh]

really need this one ASAP

[mariasemionova]

I am sorry if it is out of scope of this thread. But I didn't find anything more related to my question:
Is there a way to use a single "aws-amplify/auth" configuration across multiple microfrontend apps?

I have a monorepo (Turborepo managed with pnpm) where all authentication logic is centralized in the main app. The other apps function as subpaths of the main app, facilitated by Next.js rewrites (NextJS 14 App Router).
However, when I navigate to a subapp, it seems that the "aws-amplify/auth" context is lost.

I'm trying to run Amplify.configure(amplify_outputs) with the same configuration in all subapps as early as possible (root layout). I was hoping this would allow it to recognize session data from Cognito cookies, which are accessible to the subapps.

However, when I call "fetchAuthSession()" from "aws-amplify/auth", it returns no data, indicating that the user is unauthenticated.

Does anyone know of an example of a similar setup or have suggestions on how to resolve this?

[el-frontend]

Any news on this feature? I need to create an Amplify app that uses an existing Cognito and adds some maps with policies attached to it. Currently, it’s impossible for me to do so using the existing documentation.

[Zboi04]

I feel this feature is very needed by many (especially me)! Would love to see this implemented.

[josefaidt]

Hey folks 👋 I wanted to drop a note and say we are actively thinking about this issue 🙂

@mariasemionova would you mind filing an issue over on our js repo? this sounds like an interesting use case and something we should document 🙂 https://github.com/aws-amplify/amplify-js

[caioquirino]

@josefaidt this is awesome to know! I am happy to contribute to it, would you like to give a briefing of the necessary effort, or split it into sub tasks? Cheers!

[mariasemionova]

Hey folks 👋 I wanted to drop a note and say we are actively thinking about this issue 🙂

@mariasemionova would you mind filing an issue over on our js repo? this sounds like an interesting use case and something we should document 🙂 https://github.com/aws-amplify/amplify-js

I filled an issue, thank you for redirecting me to the correct repo.
Here is the link just in case if other people are looking for something similar:
aws-amplify/amplify-js#13850

[afern247]

+1 for this

[mablay-cap]

Here's a workaround to use your AMPLIFY Gen 2 GraphQL backend with an existing Cognito UserPool.

In your backend amplify/data/backend.ts

import { defineBackend } from '@aws-amplify/backend'
import { auth } from './auth/resource' // the old "login with email" default auth from the docs
import { data } from './data/resource'

const backend = defineBackend({
  auth, // keep this!
  data
})

/* override the GraphQL user pool id */

const graphqlApi = backend.data.resources.cfnResources.cfnGraphqlApi
  
if (graphqlApi.userPoolConfig === undefined || !('awsRegion' in graphqlApi?.userPoolConfig)) {
  throw new Error ('Missing userPoolConfig!')
}

graphqlApi.userPoolConfig = {
  ...graphqlApi.userPoolConfig,
  userPoolId: '<your user pool id>' // enter the id of your existing user pool
}

With this change your GraphQL backend is tied to your existing Cognito user pool.
I still needed to deploy the unused "login with email" auth component.

Now to the fontend. Wherever you do AMPLIFY.configure...

import { Amplify } from 'aws-amplify'
import outputs from './amplify_outputs.json' // this is a generated file!

export function configureAmplify () {
  Amplify.configure(outputs)
  const config = Amplify.getConfig()
  Amplify.configure({
    ...config,
    Auth: {
      Cognito: {
        userPoolId: '<your value>',
        userPoolClientId: '<your value>',
        identityPoolId: '<your value>',
      },
    }
  })

  // remove the next line once you have confirmed that it works
  console.log('AMPLIFY config:', Amplify.getConfig())
}

I hope this helps. But I also hope, this will soon no longer be necessary.
The code works for me, If it doesn't work for you please let me know, maybe I did some copy paste errors.
Also, if you're using other backend resources besides GraphQL, they might also need to be associated
with the existing user pool id in a similar fashion as shown above. I did not test that yet.

✨ Happy coding ✨

[cthree]

I'm looking forward to this being added. 👍

[gabrielbastien]

I would recommend you consider allowing users to use some existing resources as well as create new ones. I'll explain a use case that seems very reasonable and common.

Scenario:

1. We deploy App1 and with it a UserPool, IdentityPool, and UserPoolClient. The app matures and accumulates users.
2. We conceive of some new functionality that is related to App1 but not exactly the same app. So we deploy App2 that offers the same user base new functionality. App1 and App2 are separate enough that they should not be rolled into one deployment and have different release cycles.
3. We want to reuse the UserPool in App1 since both apps are used by the same users...however we want to create a new IdentityPool and a new UserPoolClient for App2.

Ideally, AWS Amplify should support this scenario. It will be very common with some dev teams. If you disagree please explain why! Glad to learn.

[hoabuiduy]

Hi everyone, I still get the same issue.
I use existing User Pool for Auth but I cannot use it for Amplify Data any more.
It raise an error: "NoSignedUser: No current user"
Please help!