Repository: aws/serverless-application-model

Issue:
Cognito Events Transform to Wrong Permission
# Description

When creating a Function which responds to Cognito events, like this:

```yaml
Events:
  UserPoolPreAuthentication:
    Type: Cognito
    Properties:
      UserPool: !Ref TheUserPool
      Trigger: PreAuthentication
```
...the transformation includes this permission:

```json
"TheFunctionCognitoPermission": {
  "Type": "AWS::Lambda::Permission",
  "Properties": {
    "Action": "lambda:invokeFunction",
    "FunctionName": {
      "Ref": "TheFunction"
    },
    "EventSourceToken": {
      "Ref": "TheUserPool"
    },
    "Principal": "cognito-idp.amazonaws.com"
  }
}
```

...which I believe is incorrect and causing invocations to fail, blocking (pre-)authentication. The `EventSourceToken` appears only to be used for Alexa something-something. Permissions for invocation by Cognito should be using `SourceArn`. (With `Fn:GetAtt` of the `Arn` of `TheUserPool`, natch.)

# Steps to Reproduce

1. Create a SAM template which responds to Cognito events.
2. Attempt to log in to a Cognito User Pool protected resource.
3. Note that the error response includes an description of "PreAuthentication invocation failed due to error AccessDeniedException".

# Observed Result

The Function is never invoked. Its CloudWatch log stream is never even created.

# Expected Result

The, uh, the Function is invoked? I'm not sure what to put here. I'd expect the `AWS::Lambda::Permission` resource to be well-formed and correct for the service which is expected to be performing the invocation, I guess?



Discussion:

Resolving patch:
diff --git a/samtranslator/model/eventsources/push.py b/samtranslator/model/eventsources/push.py
--- a/samtranslator/model/eventsources/push.py
+++ b/samtranslator/model/eventsources/push.py
@@ -3,7 +3,7 @@
 from six import string_types
 from samtranslator.model import ResourceMacro, PropertyType
 from samtranslator.model.types import is_type, list_of, dict_of, one_of, is_str
-from samtranslator.model.intrinsics import ref, fnSub, make_shorthand, make_conditional
+from samtranslator.model.intrinsics import ref, fnGetAtt, fnSub, make_shorthand, make_conditional
 from samtranslator.model.tags.resource_tagging import get_tag_list
 
 from samtranslator.model.s3 import S3Bucket
@@ -838,9 +838,10 @@ def to_cloudformation(self, **kwargs):
         userpool_id = kwargs['userpool_id']
 
         resources = []
+        source_arn = fnGetAtt(userpool_id, 'Arn')
         resources.append(
             self._construct_permission(
-                function, event_source_token=self.UserPool, prefix=function.logical_id + "Cognito"))
+                function, source_arn=source_arn, prefix=function.logical_id + "Cognito"))
 
         self._inject_lambda_config(function, userpool)
         resources.append(CognitoUserPool.from_dict(userpool_id, userpool))


Test patch:
diff --git a/tests/translator/output/aws-cn/cognito_userpool_with_event.json b/tests/translator/output/aws-cn/cognito_userpool_with_event.json
--- a/tests/translator/output/aws-cn/cognito_userpool_with_event.json
+++ b/tests/translator/output/aws-cn/cognito_userpool_with_event.json
@@ -85,8 +85,11 @@
         "FunctionName": {
           "Ref": "ImplicitApiFunction"
         },
-        "EventSourceToken": {
-          "Ref": "UserPool"
+        "SourceArn": {
+          "Fn::GetAtt": [
+            "UserPool",
+            "Arn"
+          ]
         },
         "Principal": "cognito-idp.amazonaws.com"
       }
diff --git a/tests/translator/output/aws-us-gov/cognito_userpool_with_event.json b/tests/translator/output/aws-us-gov/cognito_userpool_with_event.json
--- a/tests/translator/output/aws-us-gov/cognito_userpool_with_event.json
+++ b/tests/translator/output/aws-us-gov/cognito_userpool_with_event.json
@@ -85,8 +85,11 @@
         "FunctionName": {
           "Ref": "ImplicitApiFunction"
         },
-        "EventSourceToken": {
-          "Ref": "UserPool"
+        "SourceArn": {
+          "Fn::GetAtt": [
+            "UserPool",
+            "Arn"
+          ]
         },
         "Principal": "cognito-idp.amazonaws.com"
       }
diff --git a/tests/translator/output/cognito_userpool_with_event.json b/tests/translator/output/cognito_userpool_with_event.json
--- a/tests/translator/output/cognito_userpool_with_event.json
+++ b/tests/translator/output/cognito_userpool_with_event.json
@@ -85,8 +85,11 @@
         "FunctionName": {
           "Ref": "ImplicitApiFunction"
         },
-        "EventSourceToken": {
-          "Ref": "UserPool"
+        "SourceArn": {
+          "Fn::GetAtt": [
+            "UserPool",
+            "Arn"
+          ]
         },
         "Principal": "cognito-idp.amazonaws.com"
       }