AWS Cognito wrapper, ERROR: HV000: unhandled error

[anthony-berardo]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Hi Folks!

Attempting to setup AWS Cognito using the wrapper always ends in getting the below error when querying the foreign table:
SQL Error [HV000]: ERROR: unhandled error

This is happening using self-hosted and Supabase cli

Tried using the wrapper integration in Studio and following the steps below:
AWS Cognito Docs

What I'm missing here?

Thanks you!

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Go to Table editor
2. Click on the setup foreign table fro Cognito
3. Loading of the data will eventually time out and get the error from the supabase-meta container:
   {"level":"error","time":"2025-06-02T11:07:14.539Z","pid":1,"hostname":"7ebc9c1fdbef","reqId":"req-5e2","error":{"length":57,"name":"error","severity":"ERROR","code":"HV000","file":"mod.rs","line":"53","routine":"","message":"unhandled error","formattedError":"ERROR: HV000: unhandled error\n"},"request":{"method":"POST","url":"/query","pg":"db","opt":""}}

Expected behavior

Get user info from foreign table in AWS Cognito

System information

• OS: MacOS/Linux Docker
• Version of Supabase docker: (current compose file as of (https://github.com/supabase/supabase/pull/35489[)](https://github.com/supabase/supabase/commit/a57e30f8636f91a8f257fe13887fe9b026e3248c))

Additional context

Add any other context about the problem here.

[burmecia]

To make sure the connection and credentials are set up correctly, can you try use SQL to create the foreign server and table like below?

drop server cognito_server cascade;

create server cognito_server
  foreign data wrapper cognito_wrapper
  options (
    aws_access_key_id '<your_aws_key>',
    aws_secret_access_key '<your_aws_secret>',
    region 'us-east-1',
    user_pool_id 'us-east-1_TO3f0Yzke'
  );

create schema if not exists cognito;

create foreign table cognito.users (
  username text,
  email text,
  status text,
  enabled boolean,
  created_at timestamp,
  updated_at timestamp,
  attributes jsonb
)
server cognito_server
options (
   object 'users'
);

and then query the cognito.users table:

select * from cognito.users;

You can run those SQL from SQL Editor or client tools like psql to see if the error still happen.

[anthony-berardo]

I'm afraid, I'm getting the same error after the query timeout
Error: ERROR: HV000: unhandled error

Is there a way to get a more descriptive error to help troubleshoot?

[burmecia]

I suspect that might be caused the older version of Wrappers, can you try it on Supabase platform to see if still happen?

[anthony-berardo]

I did come across that bug report referencing the higher version fixing that error, is there a way to update Wrapper within the docker compose file? I'm not sure which container Wrapper is part of. Or let me know which repository to raise an issue with to ask to upgrade the version?

[burmecia]

The Wrappers extension is built and bundled within the Supabase Postgres, which is then used in the local docker compose. We're working on a new release of Supabase Postgres, and will update it in the docker compose soon. If you don't want to wait for it, you can try manually change the db image version in docker compose file with the version number from here, and then restart docker compose to see if it works.

[anthony-berardo]

I've swapped the supabase:postgres image to 15.8.1.099, however checking the version installed seems to still report 0.4.3 and I'm still getting the same error, how do you swap the installed_version?

select
  name, comment, default_version, installed_version
from
  pg_available_extensions where name='wrappers';

name	comment	default_version	installed_version
wrappers	Foreign data wrappers developed by Supabase	0.5.0	0.4.3

[anthony-berardo]

I've managed to upgrade the version using the below:

ALTER EXTENSION wrappers UPDATE;

Unfortunately, recreating the wrapper from scratch as you described below still results in Error: ERROR: HV000: unhandled error

To make sure the connection and credentials are set up correctly, can you try use SQL to create the foreign server and table like below?

drop server cognito_server cascade;

create server cognito_server
foreign data wrapper cognito_wrapper
options (
aws_access_key_id '<your_aws_key>',
aws_secret_access_key '<your_aws_secret>',
region 'us-east-1',
user_pool_id 'us-east-1_TO3f0Yzke'
);

create schema if not exists cognito;

create foreign table cognito.users (
username text,
email text,
status text,
enabled boolean,
created_at timestamp,
updated_at timestamp,
attributes jsonb
)
server cognito_server
options (
object 'users'
);

and then query the cognito.users table:

select * from cognito.users;

[burmecia]

Okay, I suspect that might be permission issue. Can you double check if the AWS key id and secret have required permission to access Cognito API, especially persmisson to call ListUsers operation? You can use below sample commands to check it:

# Find your IAM user or role ARN, copy the ARN
aws sts get-caller-identity

# Use this command to check (replace USER_ARN and USER_POOL_ARN)
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/my-user \
  --action-names cognito-idp:ListUsers \
  --resource-arns arn:aws:cognito-idp:us-east-1:123456789012:userpool/us-east-1_Abc123456