`aws cognito-idp create-identity-provider` refuses custom AttributeMapping

[eggplants]

Describe the bug

An custom AttributeMapping key containing : (like custom:foo) that can be configured via the web console are rejected when executing aws cognito-idp create-identity-provider.

❯ aws cognito-idp create-identity-provider --profile xxx --cli-input-json file://./foo-bar-idp.json

An error occurred (InvalidParameterException) when calling the CreateIdentityProvider operation: AttributeMapping contains invalid mapping: [custom:zen_groups]

./foo-bar-idp.json:

{
  "UserPoolId": "ap-northeast-1_xxx",
  "ProviderName": "FooBar",
  "ProviderType": "OIDC",
  "ProviderDetails": {...snip...},
  "AttributeMapping": {
    "custom:foo": "https://example.com/foo"
  },
  "IdpIdentifiers": []
}

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

The key for the custom AttributeMapping containing colons can be configured in aws cognito-idp create-identity-provider.

Current Behavior

That key cannot be configured.

Reproduction Steps

Specify an custom AttributeMapping with keys containing colons, such as custom:foo, as an argument to create-identity-provider.

Possible Solution

There seems to be an issue with the API-side validation provided by cognito-idp, so it might not be fixable through aws/aws-cli's fixture.

Additional Information/Context

I read:

• CreateIdentityProvider: https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html
• create-identity-provider: https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/create-identity-provider.html

Exactly same issue in Terraform:

• https://discuss.hashicorp.com/t/unable-to-create-aws-cognito-identity-provider-with-custom-attributes/75201
• aws_cognito_user does not allow for developer only custom attributes to be set hashicorp/terraform-provider-aws#26704

CLI version used

aws-cli/2.30.1 Python/3.13.7 Darwin/24.6.0 source/arm64

Environment details (OS name and version, etc.)

macOS 15.6.1

[RyanFitzSimmonsAK]

Hi @eggplants, thanks for reaching out. I was able to reproduce this issue, but I'm not totally sure it's a bug. I got the same error when I removed the colon from the input.

An error occurred (InvalidParameterException) when calling the CreateIdentityProvider operation: AttributeMapping contains invalid mapping: [custom:foo]

An error occurred (InvalidParameterException) when calling the CreateIdentityProvider operation: AttributeMapping contains invalid mapping: [customfoo]

I did find an internal ticket that observed similar behavior, and the service team responded with the following.

"We started enforcing that any attribute mapping provided on the Create/Update Identity Provider APIs must be mapped to attributes that exist in the userpool before the mapping can be set."

Does your custom:foo attribute already exist?

[eggplants]

Thank you for your answering. After I added foo to custom attributes, custom:foo can be configured!

aws cognito-idp add-custom-attributes --profile *** --user-pool-id *** --custom-attributes Name="foo",AttributeDataType="String"
aws cognito-idp create-identity-provider --profile *** --cli-input-json file://./foo-bar-idp.json

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.