AWS Cognito custom domain fails to create — "Invalid request provided: AWS::Cognito::UserPoolDomain"

Question

I'm creating an Amazon Cognito user pool with a custom user pool domain using AWS CDK.

My setup:

A parent domain (mycompany.app)
A delegated subdomain (education.mycompany.app) created as a separate delegated Route 53 public hosted zone
In CDK I create:
- The user pool
- A SAML provider
- A user pool client
- A certificate in us-east-1 using DnsValidatedCertificate
- Then a UserPoolDomain configured with that certificate (auth.education.mycompany.app)

Everything deploys fine until I add the UserPoolDomain. At that point the deployment fails with:

Resource handler returned message: "Invalid request provided: AWS::Cognito::UserPoolDomain"

Running:

aws cognito-idp describe-user-pool-domain \
  --domain auth.education.hairtracker.app

returns:

{}

So the domain is not already in use and never gets created.

I verified:

DNS delegation is correct
The (ACM) certificate is valid (correct CN, no SANs)
Certificate is in us-east-1
No pre-existing Cognito custom domain
Works fine in other zones

David Carboni · Accepted Answer · 2025-11-29 18:59:10Z

0

Eventually I found the root cause:
the delegated hosted zone (education.mycompany.app) had no A or alias record at the zone apex.

It seems that when the zone apex is empty, Cognito refuses to create a user pool custom domain in a subdomain (e.g. auth.<zone name>) of that hosted zone.

After adding any apex A/alias record, custom user pool domain creation succeeds.

Even if the parent domain (mycompany.app) has an apex A/alias record, Cognito evaluates the hosted zone that owns the subdomain being validated, not the parent zone. So an apex record must exist in the delegated zone (education.mycompany.app).

answered 1 hour ago

David Carboni

2,2862 gold badges30 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

AWS Cognito custom domain fails to create — "Invalid request provided: AWS::Cognito::UserPoolDomain"

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related