chore(cognito): validate custom attribute names don't conflict with standard attributes #36010
+105
−0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue # (if applicable)
Closes #31593.
Reason for this change
Custom attributes in Cognito User Pools with names matching standard attributes (e.g.,
name,email,phone_number) were silently dropped by CloudFormation during deployment. This led to runtime failures with no clear indication of the problem, making it difficult for developers to diagnose the issue.Description of changes
Added synthesis-time validation in the
UserPool.schemaConfigurationmethod to detect name collisions between custom attributes and standard attributes:ValidationErrorwith the conflicting attribute name and a complete list of standard attributesExample error message:
Standard attributes validated (20 total):
address,birthdate,email,family_name,gender,given_name,locale,middle_name,name,nickname,phone_number,picture,preferred_username,profile,zoneinfo,updated_at,website,email_verified,phone_number_verifiedBreaking changes: None. This change only affects code that was already broken (silent failures). Existing valid configurations continue to work unchanged.
Describe any new or updated permissions being added
N/A - No IAM permissions or resource access changes.
Description of how you validated changes
Unit tests: Added 5 comprehensive test cases covering:
name)Test results: All 344 existing tests pass (100% success rate), plus 5 new tests
Regression testing: Verified no impact on existing functionality
JSII compatibility: Confirmed ValidationError works across all language bindings
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license