# Adding Auth to Our Serverless App

**URL:** <https://discourse.sst.dev/t/adding-auth-to-our-serverless-app/2457>\
**Category:** Chapter Comments\
**Created:** [August 26, 2021, 1:13am UTC](https://discourse.sst.dev/t/adding-auth-to-our-serverless-app/2457 "2021-08-26T01:13:52Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [August 26, 2021, 1:13am UTC](https://discourse.sst.dev/t/adding-auth-to-our-serverless-app/2457/1 "2021-08-26T01:13:52Z")

</div>

Link to chapter — [https://serverless-stack.com/chapters/adding-auth-to-our-serverless-app.html](https://serverless-stack.com/chapters/adding-auth-to-our-serverless-app.html)

---

<div class="post-metadata">

**Author:** ![bike-bill](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/bike-bill/32/1220_2.png) [@bike-bill](https://discourse.sst.dev/u/bike-bill)\
**Post date:** [September 4, 2021, 1:03pm UTC](https://discourse.sst.dev/t/adding-auth-to-our-serverless-app/2457/3 "2021-09-04T13:03:17Z")

</div>

I missed something in lib/index.js

Specifically, I did not create a new variable  
`const apiStack = new ApiStack(...`  
and use it in the new AuthStack constructor

```auto
new AuthStack(app, 'auth', {
    api: apiStack.api, ...

```

I mistakenly had `api: ApiStack.api`

This caused a build time error with a message of  
`error: The specified permissions are not supported.`

Of course, with the correct code, everything works as expected. Posting this here if someone else runs into this.

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [September 7, 2021, 1:12am UTC](https://discourse.sst.dev/t/adding-auth-to-our-serverless-app/2457/5 "2021-09-07T01:12:55Z")

</div>

Makes sense. Thanks for sharing!

---

<div class="post-metadata">

**Author:** ![DMGithinji](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/dmgithinji/32/1223_2.png) [@DMGithinji](https://discourse.sst.dev/u/DMGithinji)\
**Post date:** [September 7, 2021, 10:39am UTC](https://discourse.sst.dev/t/adding-auth-to-our-serverless-app/2457/6 "2021-09-07T10:39:20Z")

</div>

```auto
Error [ValidationError]: Template format error: Unrecognized resource types: [AWS::Cognito::UserPool, AWS::Cognito::IdentityPoolRoleAttachment, AWS::Cognito::UserPoolClient, AWS::Cognito::IdentityPool
]

```

Might anyone have come across this error while going through section?  
If you have an idea why this might be happening, I’ll appreciate it

---

<div class="post-metadata">

**Author:** ![DMGithinji](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/dmgithinji/32/1223_2.png) [@DMGithinji](https://discourse.sst.dev/u/DMGithinji)\
**Post date:** [September 7, 2021, 12:23pm UTC](https://discourse.sst.dev/t/adding-auth-to-our-serverless-app/2457/7 "2021-09-07T12:23:29Z")

</div>

My bad, had used a Cape Town as my region, which apparently doesn’t support. Reverted to the default region in the guide.

---

<div class="post-metadata">

**Author:** ![aryan1107](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/aryan1107/32/1270_2.png) [@aryan1107](https://discourse.sst.dev/u/aryan1107)\
**Post date:** [January 17, 2022, 8:45pm UTC](https://discourse.sst.dev/t/adding-auth-to-our-serverless-app/2457/8 "2022-01-17T20:45:24Z")

</div>

In this section when I run

```auto
npx sst add-cdk @aws-cdk/aws-iam

```

I get an error

❌ @aws-cdk/aws-iam is an AWS CDK v1 package. Only v2 packages are supported.

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [January 17, 2022, 9:13pm UTC](https://discourse.sst.dev/t/adding-auth-to-our-serverless-app/2457/9 "2022-01-17T21:13:29Z")

</div>

We are in the process of updating the guide to CDK v2, so these steps will change soon!

---

<div class="post-metadata">

**Author:** ![harinanda18](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/harinanda18/32/1553_2.png) [@harinanda18](https://discourse.sst.dev/u/harinanda18)\
**Post date:** [August 18, 2024, 10:53am UTC](https://discourse.sst.dev/t/adding-auth-to-our-serverless-app/2457/11 "2024-08-18T10:53:12Z")

</div>

BBCODE

```auto
new iam.PolicyStatement({
  actions: ["s3:*"],
  effect: iam.Effect.ALLOW,
  resources: [
    bucket.bucketArn + "/private/${cognito-identity.amazonaws.com:sub}/*",
  ],
}),

```

where this code need to be placed

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [August 21, 2024, 8:02pm UTC](https://discourse.sst.dev/t/adding-auth-to-our-serverless-app/2457/12 "2024-08-21T20:02:06Z")

</div>

Oh that’s from a previous version. It should be referencing the snippet from above instead.

```auto
     {
        actions: ["s3:*"],
        resources: [
          $concat(bucket.arn, "/private/${cognito-identity.amazonaws.com:sub}/*"),
        ],
      },

```

---

<div class="post-metadata">

**Author:** ![ericmasiello](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/ericmasiello/32/1439_2.png) [@ericmasiello](https://discourse.sst.dev/u/ericmasiello)\
**Post date:** [August 26, 2025, 11:05am UTC](https://discourse.sst.dev/t/adding-auth-to-our-serverless-app/2457/13 "2025-08-26T11:05:19Z")

</div>

Yeah. I had the same question.