AWS Cognito Post Confirmation 触发器超时及重复执行问题咨询

场景说明 #

正在使用AWS Cognito创建用户，需求为用户状态变更为已确认后，将用户邮箱、手机号存储至对应数据表，因此采用Post Confirmation Trigger实现逻辑，整套代码通过AWS SAM部署到AWS。

不同超时配置下的异常表现 #

3秒超时配置 #

将template.yaml中函数超时设置为3秒时，触发器可成功向数据表写入数据，但抛出如下错误：

PostConfirmation failed with error 2021-02-17T12:38:19.276Z f3d281dd-0dff-46a4-9154-3bb042a923c4 Task timed out after 3.00 seconds. (Service: AWSCognitoIdentityProviderService; Status Code: 400; Error Code: UserLambdaValidationException; Request ID: 242c6008-ef19-4015-b651-948620d8e04c; Proxy: null)

5秒超时配置 #

为规避上述超时错误，将template.yaml中的超时调整为5秒，此时出现新问题：即使用户已完成确认，触发器仍会多次执行，抛出如下错误：

User cannot be confirmed. Current status is CONFIRMED (Service: AWSCognitoIdentityProviderService; Status Code: 400; Error Code: NotAuthorizedException; Request ID: 50da31dc-5c03-4af3-adef-cafca16b1ad0; Proxy: null)

两种场景下，用户均可正常完成确认，且触发器均成功向数据表写入数据，但上述报错会对问题排查造成误导。初步怀疑问题根源是template.yaml中配置的超时参数，想确认是否有其他开发者遇到过Post Confirmation触发器的同类问题，希望能定位问题根因并消除上述报错。

对应SAM模板配置 #

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  SAM Template
  
Globals:
  Function:
    Timeout: 5
    Runtime: nodejs12.x

Parameters:
  cognitoUserPoolArn:
    Type: String
  userIamRool:
    Type: String
  StageName:
    Type: String
    Default: dev

Resources:
  AWSApiGateway:
    Type: AWS::Serverless::Api
    Properties:
      Name: xxxxxxx
      StageName: !Ref StageName
      Cors: "'*'"
      Auth:
        DefaultAuthorizer: MyCognitoAuthorizer
        Authorizers:
          MyCognitoAuthorizer:
            UserPoolArn: !Ref cognitoUserPoolArn
      GatewayResponses:
        UNAUTHORIZED:
          StatusCode: 401
          ResponseParameters:
            Headers:
              Access-Control-Expose-Headers: "'WWW-Authenticate'"
              Access-Control-Allow-Origin: "'*'"

  postConfirmationCognitoTrigger:  
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: build/
      Handler: postConfirmationCognitoTrigger.postConfirmationDentistTrigger
      Role: arn:aws:iam::xxxxxxxxx:role/lambda-xxxxxxxx-executionrole
  
  GetPatientOnboardingQuestionnaireFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: build/
      Handler: getPatientOnboardingQuestions.lambdaHandler
      Role: arn:aws:iam::xxxxxxxxx:role/lambda-xxxxxxxxxx-executionrole
      Events:
        HelloWorld:
          Type: Api 
          Properties:
            RestApiId: !Ref AWSApiGateway
            Path: /dev/api/v1/patient/getPatientOnboardingQuestions
            Method: GET
            Auth:
              Authorizer: 'MyCognitoAuthorizer'

内容的提问来源于stack exchange，提问作者Sneha Herle