Cognito account recovery settings missing new options

[shousper]

The accountRecoverySetting.recoveryMechanisms input block appears to be missing support for the "Not Recommended" option in Cognito's console.

After making a manual change in the AWS Console to "How will a user be able to recover their account?" and doing a pulumi refresh, the values of recoveryMechanisms were removed. Now, even when ignoring changes to accountRecoverySetting I'm faced with this error:

error: aws:cognito/userPool:UserPool resource 'app' has a problem: List shorter than MinItems: Attribute supports 1 item minimum, config has 0 declared. Examine values at 'UserPool.AccountRecoverySetting.RecoveryMechanism'.

Which I can recover from, no worries, It probably means the pulumi-aws provider isn't consuming the API response for the state of the User Pool correctly?

Expected behavior

UserPool resource should correctly maintain state with AWS.

Current behavior

recoveryMechanisms appears to become empty when "(Not Recommended) Phone if available, otherwise email, and do allow a user to reset their password via phone if they are also using it for MFA." option is chosen in the UI.

Steps to reproduce

1. Define a basic aws.cognito.UserPool resource.
2. pulumi up.
3. Log into AWS Console, change "How will a user be able to recover their account?" to "(Not Recommended) Phone if available, otherwise email, and do allow a user to reset their password via phone if they are also using it for MFA."
4. pulumi refresh
5. Observe diff to recoveryMechanisms will remove all elements.

Context (Environment)

Trying to enable phone number account recovery, regardless of MFA.

Affected feature

aws.cognito.UserPool

[aterreno]

I just bumped into this, it's strange as we continously deploy infra with pulumi.. but I got the error only today.

Solved adding:

      accountRecoverySetting: {
        recoveryMechanisms: [{ name: 'verified_email', priority: 1 }],
      },

[chamathpali]

@aterreno thanks for that! spend few hours trying to find a suitable fix! 👍

[corymhall]

I've only been able to reproduce this issue when providing something like the below example. I will note though that when using the below app, the error message is correct! I've tried with a bunch of other combinations and I cannot reproduce this error with any other configuration.

new aws.cognito.UserPool('chall-pool', {
  accountRecoverySetting: {},
});

My hunch is that this has been fixed sometime since this was reported. If anyone is still experiencing this issue please let us know!