Christopher Piggott

> 11:07:43 AM | CREATE_FAILED | AWS::Cognito::IdentityPoolRoleAttachment | AuthRoleAttachment0 C8CE9CC Ahh okay, I was wrong. What you're showing is that it is actually something in CloudFormation, not the CDK. I'm...

My workaround for this was to create an [AwsCustomResource](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.custom_resources.AwsCustomResource.html) that called [PutRolePolicy](https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutRolePolicy.html) which does an _add or replace_. In my case I implemented onCreate, onUpdate, and onDelete. I think these...

> Yes I as well want to grant different permissions to users depending on what cognito group they belong to. I assume that must be a somewhat common use case....

> I think that all this role generation should be handled by the developer and not hidden inside the framework but anyway if we go that route this needs to...

I am using this buf registry so it would be extraordinarily helpful to me if this would be fixed.

> We can stop publishing to bsr as we aren't using any code generated from there anymore. You aren't, but others (like me) are still using it. It looks like...