Unable to create aws_cognito_identity_provider with custom attributes

Terraform Providers AWS
1

Hi all,

I am trying to create a aws_cognito_identity_provider-resource using the following code:

resource “aws_cognito_identity_provider” “this” {
user_pool_id = aws_cognito_user_pool.this.id
provider_name = oidc_provider
provider_type = var.identity_provider_type

provider_details = {
attributes_request_method = var.identity_provider_attributes_request_method
attributes_url_add_attributes = var.identity_provider_attributes_url_add_attributes
authorize_scopes = var.identity_provider_authorize_scopes
client_id = data.aws_ssm_parameter.idp_client_id.value
client_secret = data.aws_ssm_parameter.idp_client_secret.value
oidc_issuer = data.aws_ssm_parameter.idp_oidc_issuer.value
}

attribute_mapping = var.identity_provider_attribute_mapping
}

With:

variable “identity_provider_attribute_mapping” {
description = “Attribute mapping for the identity provider”
type = map(string)
default = {
“custom:groups” = “groups”
“email” = “email”
“name” = “name”
“preferred_username” = “preferred_username”
“username” = “sub”
}
}

While turning the debug-log I can see http.request.body for the request to aws-api looks like this:

{
“AttributeMapping”: {
“preferred_username”: “preferred_username”,
“custom:groups": "groups”,
“username”: “sub”,
“email”: “email”,
“name”: “name”
},
“ProviderName”: “some-name”,
“UserPoolId”: “some-pool”
}

I get the error:

…InvalidParameterException: AttributeMapping contains invalid mapping: [custom:groups]
│
│ with module.mapreduce.module.cognito.aws_cognito_identity_provider.this,
│ on .terraform/modules/mapreduce.cognito/main.tf line 10, in resource “aws_cognito_identity_provider” “this”:
│ 10: resource “aws_cognito_identity_provider” “this” {

Looking into Request in CloudTrail:

"errorMessage": "AttributeMapping contains invalid mapping: [custom:groups]",
31 "requestParameters": {
32 "userPoolId": "XXX",
33 "providerName": "XXX",
34 "providerType": "OIDC",
35 "providerDetails": {
36 "authorize_scopes": "openid email profile",
37 "client_secret": "XXX",
38 "attributes_url_add_attributes": "false",
39 "attributes_request_method": "GET",
40 "client_id": "XXX",
41 "oidc_issuer": "https://login.microsoftonline.com/XXX/v2.0"
42 },
43 "attributeMapping": {
44 "name": "name",
45 "preferred_username": "preferred_username",
46 "custom:groups": "groups",
47 "email": "email",
48 "username": "sub"
49 }
50 },

I don’t get where the square brackets are being added, but they seem to the problem here. I’ve also tried different types adding and escaping “custom:groups”: “groups” with no luck.

I tried using the latest stalbe aws-provider in version 5.98.0.

Any ideas on that?

PS: Someone else Palready had a similar issue:

2

FYI this might be similar to the following long-standing issue that has yet to be resolved:

Perhaps the AWS CC Provider’s awscc_cognito_user_pool_identity_provider resource would work better at handling attribute names with colons.