(gen2-migration) `lock` fails in Planning with "Unable to find nested stack logical id prefix" for imported auth

[gotnaoki]

How did you install the Amplify CLI?

npm (npm install -g @aws-amplify/cli)

If applicable, what version of Node.js are you using?

v20 (also reproduced on v23)

Amplify CLI Version

14.5.1

What operating system are you using?

Mac

Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No manual changes to the Amplify-managed stack. The auth resource is an existing Cognito user pool brought in via amplify import auth (not created by amplify add auth), following the imported-auth guidance: https://docs.amplify.aws/gen1/react/tools/console/auth/import/

Describe the bug

amplify gen2-migration lock fails during the Planning phase for a project whose auth category is an imported Cognito resource. This reproduces with imported auth alone — no GraphQL API or other category is required. It throws:

🛑 Unable to find nested stack logical id prefix: auth<resourceName>
→ Planning failed

amplify status reports no changes for the project.

This appears to be distinct from #14702. #14702 was a false-positive Drift failure in the Validating phase (fixed by #14803). The failure here happens earlier, in Planning, and is not skippable with --skip-validations (that flag only skips the Validating phase).

Observed root cause (from reading the bundled CLI 14.5.1):

• In the lock step, planning iterates over Gen1App.discover() and switches on resource.key. For auth it matches auth:Cognito and calls findNestedStack(nestedStacks, "auth<resourceName>").
• An imported auth resource is not represented as a CloudFormation nested stack, so no logical id starts with that prefix, and findNestedStack throws.
• discover() derives key from resourceMeta.service only; it does not consider resourceMeta.serviceType === "imported". So imported auth is treated the same as a managed Cognito resource and enters the nested-stack lookup path.

This is consistent with #14781 ("unsupported imported resources are not skipped"), which notes imported resources (excluding auth) are not identified — here the auth import specifically is not skipped in the lock planning path.

For reference, Import auth is listed as fully supported (🟢) in the migration Feature Parity matrix, which does not match the observed behavior: https://docs.amplify.aws/react/start/migrate-to-gen2/feature-matrix/

Expected behavior

amplify gen2-migration lock should handle an imported auth resource without failing in Planning — either by skipping the nested-stack lookup for imported resources (they are not part of the Amplify-managed CloudFormation stack), or by treating imported auth the way amplify status does (no change), so that migration can proceed.

Reproduction steps

1. Create a Cognito user pool + app client(s) + identity pool outside of Amplify (e.g. via the AWS Console or CLI).
2. In a fresh Gen 1 project (amplify init), bring the Cognito resources in with amplify import auth (imported auth, not amplify add auth). No other category is needed.
3. amplify push. Confirm amplify status shows no changes.
4. Install @aws-amplify/cli@14.5.1 (migration tooling included).
5. Run amplify gen2-migration lock.
6. Observe the Planning-phase failure: Unable to find nested stack logical id prefix: auth<resourceName>.
7. Re-run with amplify gen2-migration lock --skip-validations. Observe the same Planning failure (the flag does not help because the failure is in Planning, before Validating).

Project Identifier

No response

Log output

Details

→ Planning failed

🛑 Unable to find nested stack logical id prefix: auth<resourceName>

Learn more at: https://docs.amplify.aws/cli/project/troubleshooting/

Session Identifier: xxxxxxx
✔ An unexpected error has occurred, opt in to send an error report to AWS Amplify with non-sensitive project configuration files. Confirm  (y/N) 

Additional information

• Reproduced on CLI 14.5.1 (the current latest Gen 1 CLI at the time of writing).
• Related: (gen2-migration) lock reports drift for imported auth resource #14702 (Validating-phase false drift for imported auth; fixed by fix(gen2-migration): imported resources report false drift #14803), (gen2-migration) unsupported imported resources are not skipped #14781 (imported resources not skipped).

Before submitting, please confirm:

• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
• I have removed any sensitive information from my code snippets and submission.