(cognito): permissions for lambda triggers are created in the lambda's scope instead of the user pool's scope

[abrgr]

Describe the bug

If you create a lambda in stack A and then use that lambda as a cognito UserPool trigger in stack B, you will get a circular reference error.

The problem stems from the fact that, when the UserPool calls fn.addPermission from UserPool.prototype.addLambdaPermission, it does not pass a scope on the permission. FunctionBase.prototype.addPermission uses the function's scope if no scope is present on the permission.

Expected Behavior

The permission should be added in the UserPool's scope, not in the lambda function's scope. If the scopes differ, adding the permission in the UserPool's scope guarantees a circular reference error.

Current Behavior

A circular reference is created because the permission is added in the IFunction's scope instead of the UserPool's scope.

Reproduction Steps

1. Create stack A with a lambda function, func
2. Create stack B with a UserPool, passing func as a lambda trigger
3. Notice that you get a circular reference error

Possible Solution

In

aws-cdk/packages/@aws-cdk/aws-cognito/lib/user-pool.ts

Line 978 in e2deca0

private addLambdaPermission(fn: lambda.IFunction, name: string): void {

, pass scope as a field on the permission passed to addLambdaPermission.

Desired code:

  private addLambdaPermission(fn: lambda.IFunction, name: string): void {
    const capitalize = name.charAt(0).toUpperCase() + name.slice(1);
    fn.addPermission(`${capitalize}Cognito`, {
      principal: new ServicePrincipal('cognito-idp.amazonaws.com'),
      sourceArn: Lazy.string({ produce: () => this.userPoolArn }),
      scope: this // <--- this is the new line
    });
  }

Additional Information/Context

No response

CDK CLI Version

8.15.0

Framework Version

No response

Node.js Version

v16.17.0

OS

linux

Language

Typescript

Language Version

No response

Other information

No response

[kaizencc]

hi @abrgr, thanks for letting us know! Are you interested in picking this up? Would need a few tests in addition to the 1 line change to ensure that its all working smoothly.

[abrgr]

Happy to put up a PR. Just wanted to make sure that you're in agreement that the permission should be created in the UserPool's scope before I put up the change. It sounds like you're aligned with that?

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[abrgr]

Thanks @jogold!