Cognito: Device Tracking Setting Resets After Adding Lambda Triggers for Cognito via CDK

[cjnoname]

Describe the bug

When adding or modifying Lambda triggers for an Amazon Cognito User Pool using AWS CDK, the Device Tracking setting is unexpectedly reset. This requires manual reconfiguration after each deployment.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

The Device Tracking setting should retain its configured value after adding or modifying Lambda triggers via AWS CDK.

Current Behavior

The Device Tracking setting is reset, requiring manual reconfiguration after each CDK deployment.

Reproduction Steps

The scripts we use:

  const customResourceLambdaName = `${lambdaName}-custom-resource`;
  const customResourceId = `CustomResourceCognito${generateResourceId(lambdaName)}`;

  lambda.addPermission("CognitoInvokePermission", {
    principal: new ServicePrincipal("cognito-idp.amazonaws.com"),
    action: "lambda:InvokeFunction",
    sourceArn: `arn:aws:cognito-idp:${stack.region}:${stack.account}:userpool/${cognitoUserPoolId}`
  });

  const updateUserPoolTrigger = new AwsCustomResource(stack, customResourceId, {
    functionName: customResourceLambdaName,
    role: new Role(stack, `${customResourceId}Role`, {
      roleName: `${customResourceLambdaName}-role`,
      assumedBy: new ServicePrincipal("lambda.amazonaws.com"),
      inlinePolicies: {
        InlinePolicy: new PolicyDocument({
          statements: [
            new PolicyStatement({
              effect: Effect.ALLOW,
              actions: ["cognito-idp:UpdateUserPool"],
              resources: [
                `arn:aws:cognito-idp:${stack.region}:${stack.account}:userpool/${cognitoUserPoolId}`
              ]
            })
          ]
        })
      }
    }),
    onCreate: {
      service: "CognitoIdentityServiceProvider",
      action: "updateUserPool",
      parameters: {
        UserPoolId: cognitoUserPoolId,
        LambdaConfig: events
      },
      physicalResourceId: PhysicalResourceId.of(customResourceId)
    }
  });

  updateUserPoolTrigger.node.addDependency(lambda);

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.177.0

Framework Version

No response

Node.js Version

22.13.1

OS

MacOS 15.1.1

Language

TypeScript

Language Version

No response

Other information

No response