Access denied when adding url from Netlify to allowed_origins about amazon-cognito-passwordless-auth HOT 10 CLOSED

@ottokruse This issue was linked to setting the wrong client_id for cognito in netlify. The correct id has been set for the env vars and the solution works as intended.

Apologies for the inconvenience!

from amazon-cognito-passwordless-auth.

Best check the logs of the Verify Auth challenge lambda function? It's that lambda function that reports it does not have access in your message. Hopefully the stack trace in the logs reports what the lambda function was doing. Otherwise set loglevel to Debug.

Looks like it's unrelated to the Netlify move by the way?

from amazon-cognito-passwordless-auth.

The Verify Auth challenge lambda function is never invoked, all we get is a 400 response with the error message provided above. The log_level is already set to DEBUG

from amazon-cognito-passwordless-auth.

Hard to follow what it happening. Maybe the User Pool does not have permission to invoke the lambda function. This permission is created automatically by the CDK stack but maybe got inadvertantly removed. (Still I see no reason why this would be related to a move from S3 to Netlify)

from amazon-cognito-passwordless-auth.

Maybe of help: https://stackoverflow.com/questions/42460846/when-i-try-to-login-using-aws-cognito-i-get-an-accessdeniedexception-about-my-cu

from amazon-cognito-passwordless-auth.

Any luck @seel93 ?
If not can you provide more details? Eg show how you use the Passwordless construct and how you deploy. Ideally we can reproduce. Also, what version of the passwordless lib are you on ?

from amazon-cognito-passwordless-auth.

We're only using a small part of the code in this repo and using terraform instead of the cdk.

Magiclink is currently the only sign-in method we're using, and code for all the other methods is not a part of our repo.

This solution was working fine with s3 and cloudfront, and when we introduced Netlify the verifyAuth trigger failed to run.

I don't have the passwordless lib version in front of me right now, but will provide it asap.

from amazon-cognito-passwordless-auth.

@ottokruse we're using v0.5.1 of the passwordless lib

from amazon-cognito-passwordless-auth.

Check the resource based policy statements of the VerifyAuth lambda in the AWS console and make sure correct?

Should be something like:

And when opened:

from amazon-cognito-passwordless-auth.

Yes, I have the exact same policy. I'm assuming our webapp hosted in s3 wouldn't have worked without it

from amazon-cognito-passwordless-auth.