Why is the identity-claim sub::username when sub is not restoreable in a recovery system

[biller-aivy]

Amplify CLI Version

10.5.2

Question

https://docs.amplify.aws/cli/migration/identity-claim-changes/#what-are-the-breaking-changes
So I can read here, that in the versions of the cli the claim is sub::username, but why?

When I forced to run a recovery system and get all the old data there with the same cognito user, I can import all user, but the sub will be changed.

[josefaidt]

Hey @biller-aivy 👋 thanks for raising this! Although we are thinking about appropriate backups and recoveries, this can be changed to be better suited for a straightforward recovery by specifying an identityClaim

[biller-aivy]

@josefaidt
What seems a bit strange to me is that since version 9 I think you save sub::username as owner or? Yet you can't transfer sub to a new pool.
I already have everywhere

{
        allow: owner
        identityClaim: "username" # explicit use of username
      }

[josefaidt]

Hey @biller-aivy that's correct, and we are actively thinking about disaster recovery, which includes situations like this where the sub is non-transferrable. Unfortunately you will need to specify the custom identityClaim or toggle the useSubUsernameForDefaultIdentityClaim feature flag in amplify/cli.json to change that behavior.

[josefaidt]

Closing due to inactivity

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.