(aws-cognito): UserPoolDomain.baseUrl() returns incorrect URL for gov cloud

[kastork]

When operating in us-gov-west-1, baseUrl() returns

https://<prefix>.auth.us-gov-west-1.amazoncognito.com

when it should return

https://<prefix>.auth-fips.us-gov-west-1.amazoncognito.com

This is 🐛 Bug Report

[nija-at]

Thanks for filing this issue.
Is there any documentation around this you can point to? I'm wondering about things like the FIPS endpoint being opt-in or just standard for gov cloud.

[kastork]

One would expect this page to document ALL the gov cloud differences, but it does not: https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-cog.html. Perhaps an issue should be raised with the documentation people.

FIPs info is available here, but it doesn't mention non-fips for cognito: https://aws.amazon.com/compliance/fips/

I don't think you can opt out of FIPS for the authorization endpoint in the gov partition. This would make sense considering cognito is likely to be used to protect services that also require FIPS.

[sky-c]

@nija-at Any update or workaround on this? I presently can not deploy an API with a Cognito authorizer to GovCloud with the CDK. (Subsequent to comment, noticed aws-cloudformation/cloudformation-coverage-roadmap#553 which may be relevant)