Unable to resolve cyclic dependency between auth/data/lambdaTrigger (used by Cognito)

[timthesinner]

Environment information

OS: Linux 6.1 Amazon Linux 2023
CPU: (4) x64 Intel(R) Xeon(R) Platinum 8275CL CPU @ 3.00GHz
Memory: 5.49 GB / 7.55 GB
Shell: /bin/bash
Binaries:
Node: 18.20.8 - ~/.nvm/versions/node/v18.20.8/bin/node
Yarn: 1.22.22 - ~/.nvm/versions/node/v18.20.8/bin/yarn
npm: 10.8.2 - ~/.nvm/versions/node/v18.20.8/bin/npm
pnpm: undefined - undefined
NPM Packages:
@aws-amplify/auth-construct: 1.3.2
@aws-amplify/backend: 1.5.1
@aws-amplify/backend-auth: 1.2.0
@aws-amplify/backend-cli: 1.3.0
@aws-amplify/backend-data: 1.1.5
@aws-amplify/backend-deployer: 1.1.5
@aws-amplify/backend-function: 1.7.1
@aws-amplify/backend-output-schemas: 1.4.0
@aws-amplify/backend-output-storage: 1.1.2
@aws-amplify/backend-secret: 1.1.4
@aws-amplify/backend-storage: 1.2.1
@aws-amplify/cli-core: 1.1.3
@aws-amplify/client-config: 1.5.0
AWS environment variables:
AWS_AMPLIFY_WEB_DYNAMIC_RUNTIME = nodejs16.x
AWS_EXECUTION_ENV = AWS_ECS_EC2
AWS_AMPLIFY_AL2023_DEFAULT_BUILD_IMAGE = true
AWS_STEP_NAME = BUILD
AWS_BRANCH = main
AWS_DEFAULT_REGION = us-west-1
AWS_REGION = us-west-1
AWS_AMPLIFY_SKEW_PROTECTION_ENABLED = false
AWS_FRAMEWORK = Next.js - SSR
AWS_PLATFORM = WEB_COMPUTE
AWS_AMPLIFY_BUILD_IMAGE_VERSION = 2023-11
AWS_AMPLIFY_INTERNAL_IMAGE_OPTIMIZATION = true
AWS_MONOREPO_APPROOT = website
AWS_REQUEST_ID = 45bc395f-6911-4c29-95ab-c4a0451dcbb1
AWS_STS_REGIONAL_ENDPOINTS = regional
AWS_NODEJS_CONNECTION_REUSE_ENABLED = 1
AWS_SDK_LOAD_CONFIG = 1
No CDK environment variables

Describe the bug

Tried to follow the guidance in the docs but I keep getting a deployment error that my lambdaFunction causes a cyclic dependency.

Reproduction steps

Note that the types for the defineFunction do not accept resourceGroupName so we had to use as any to get type checking to pass.

// Example: website/amplify/functions/post-authentication-trigger/resource.ts
import { defineFunction } from "@aws-amplify/backend";

// We put this function trigger into the auth resource group to break a cyclic dependency
export const postAuthenticationTrigger = defineFunction({
  name: "post-authentication-trigger",
  entry: "./handler.ts",
  resourceGroupName: "auth", // Also tried "data"
} as any);

import { defineBackend } from "@aws-amplify/backend";
import { auth } from "./auth/resource";
import { data } from "./data/resource";
import { storage } from "./storage/resource";
import { postAuthenticationTrigger } from "./functions/post-authentication-trigger/resource";

const backend = defineBackend({
  auth,
  data,
  storage,
  postAuthenticationTrigger,
});

// Pass table name as environment variable
backend.postAuthenticationTrigger.addEnvironment(
  "USERPROFILE_TABLE_NAME",
  backend.data.resources.tables.UserProfile.tableName,
);

// Grant permissions for the function to write to the UserProfile table
backend.data.resources.tables.UserProfile.grantWriteData(
  backend.postAuthenticationTrigger.resources.lambda,
);

[sobolk]

Note that the types for the defineFunction do not accept resourceGroupName so we had to use as any to get type checking to pass.

@timthesinner The resourceGroupName was introduced in 1.8.0 version of @aws-amplify/backend-function (or 1.8.0 of @aws-amplify/backend).

Could upgrade dependencies to latest and try again?

[OperationalFallacy]

related: if lambda trigger wants to use identity pool id as env variable - it will again make cyclical unavoidable dependency. had to write pool info to ssm param to untangle it (that adds huge delay on oauth redirects)

[pahud]

Current vs Expected Behavior

Current Behavior (Problem)

flowchart TD
    subgraph "Problem: Circular Dependency"
        A[Auth Resource] --> B[Lambda Function]
        B --> C[Data Resource] 
        C --> A
        D[CloudFormation Error:<br/>Circular dependency between<br/>auth, data, function]
    end

Loading

Expected Behavior (Solution)

flowchart TD
    subgraph "Fix: Resource Group Assignment"
        A[Auth Resource Group] --> B[Lambda Function<br/>resourceGroupName: 'auth']
        B --> C[Data Resource]
        E[Successful Deployment]
    end

Loading

---

Hi @timthesinner,

The issue you're experiencing is due to a version compatibility problem. The resourceGroupName parameter was introduced in @aws-amplify/backend-function@1.8.0 (or @aws-amplify/backend@1.8.0), but you're currently using version 1.7.1.

Solution:

1. Upgrade your dependencies to the latest version:

   npm update @aws-amplify/backend @aws-amplify/backend-function

2. Remove the type assertion and use the proper syntax:

   export const postAuthenticationTrigger = defineFunction({
     name: "post-authentication-trigger",
     entry: "./handler.ts",
     resourceGroupName: "auth", // No type assertion needed
   });

The resourceGroupName parameter is designed specifically to resolve circular dependencies by grouping functions with their related resources. For auth triggers like yours, using resourceGroupName: "auth" places the function in the same CloudFormation stack as the auth resource, breaking the circular dependency.

This is part of a broader pattern of circular dependency issues in Amplify Gen2 (see related issues #2841, #1740, #2517). The team has implemented resourceGroupName as the primary solution for these scenarios.

For complex cases involving identity pool access, you may need alternative approaches like SSM parameters as mentioned in the related discussions.

Would you be able to upgrade and test this solution? We'd appreciate your feedback on whether this resolves the issue.

Thanks for contributing to the Amplify community! 🚀

[hasadata]

I have exactly the same issue, setting ressourceGroupName to auth or data still throwing the same issue