aws-cognito: UserPoolGroup.groupName wrongly set to resource ref

[robert-hanuschke]

Describe the bug

Creating a UserPoolGroup object allows for setting the groupName attribute. However, the resource constructor is overriding the field to the resource ref.

While the underlying CfnUserPoolGroup is correctly created in CloudFormation, it is impossible to refer to the actual, explicitly set groupName in the CDK code. This makes it impossible to e.g. filter for a group in an array of groups by name.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

The explicitly set groupName attribute not to be overridden but taken, set and kept as specified for later reference.

Current Behavior

groupName being overwritten with the cfn resource ref

Reproduction Steps

const userPoolGroups: cognito.UserPoolGroup[] = [];
    for (const userPoolGroupName of ["adminA", "adminB", "user"]) {
      userPoolGroups.push(
        new cognito.UserPoolGroup(this, userPoolGroupName, {
          userPool: this.userPool,
          groupName: userPoolGroupName,
        })
      );
    }

    new cdk.CfnOutput(this, "adminUserPoolGroupNames", {
      value: userPoolGroups.map((group) => group.groupName).join(", "),
    });

The output will NOT have the groupNames, but the group refs as value

Possible Solution

do not set the groupName attribute to the resource ref, but the user provided groupName

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

2.217.0

AWS CDK CLI version

2.1023.0 (build 45ceb89)

Node.js Version

v20.19.3

OS

Mac OS

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Hi @robert-hanuschke

I believe you should use Fn.join() instead, which joins the value at deploy time.

// This WILL work - using CloudFormation's Fn::Join
new cdk.CfnOutput(this, "adminUserPoolGroupNames", {
  value: Fn.join(", ", userPoolGroups.map((group) => group.groupName)),
});

The issue is in the UserPoolGroup constructor where this.groupName = resource.ref always creates a token that will only be resolved at deployment time and you can't use join(", ") to handle them in the synth time.

[pahud]

To improve this using established pattern, we should use getResourceNameAttribute() to get the resource name rather than resource.ref.

// Instead of:
this.groupName = resource.ref;

// Use the established pattern:
this.groupName = this.getResourceNameAttribute(resource.ref);

What This Pattern Does:

1. Cross-environment aware: Returns the user-provided name when used across different stacks/regions
2. Preserves CloudFormation references: Uses resource.ref when within the same environment
3. Handles the props.groupName ?? resource.ref logic automatically
4. Consistent with CDK patterns: Used throughout the codebase for this exact scenario

This is the canonical CDK way to handle the "preserve user input vs CloudFormation reference" pattern, and it's already available in the base Resource class that UserPoolGroup extends from.