From 49ba6a3bd93566ea9c653c8e77144e3dd6e52bae Mon Sep 17 00:00:00 2001
From: akshbhu <39866697+akshbhu@users.noreply.github.com>
Date: Fri, 24 Sep 2021 18:22:58 -0700
Subject: [PATCH 1/6] feat: FF for override stacks (#8228)

---
 .eslintrc.js                                  |   1 +
 .gitignore                                    |   2 +
 .../amplify-base-cdk-types.ts                 |  32 +++++
 .../category-base-schema-generator.ts         | 123 ++++++++++++++++++
 .../category-input-state.ts                   |  12 ++
 .../category-override-base.ts                 |  24 ++++
 .../src/category-interfaces/index.ts          |   4 +
 packages/amplify-cli-core/src/cliConstants.ts |  34 +++++
 .../src/feature-flags/featureFlags.ts         |  16 +++
 packages/amplify-cli-core/src/index.ts        |   3 +
 .../src/overrides-manager/index.ts            |   1 +
 .../override-skeleton-generator.ts            |  81 ++++++++++++
 .../src/state-manager/pathManager.ts          |  43 ++++++
 .../amplify-cli-overrides-helper/.npmignore   |   5 +
 .../amplify-cli-overrides-helper/CHANGELOG.md |   0
 .../amplify-cli-overrides-helper/README.md    |   1 +
 .../amplify-cli-overrides-helper/package.json |  48 +++++++
 .../amplify-cli-overrides-helper/src/index.ts |  13 ++
 .../tsconfig.json                             |   8 ++
 .../__tests__/commands/build-override.test.ts |  65 +++++++++
 .../src/commands/build-override.ts            |  59 +++++++++
 packages/amplify-cli/src/execution-manager.ts |  28 +++-
 .../get-category-pluginInfo.ts                |   8 ++
 .../amplify-helpers/push-resources.ts         |   7 +-
 .../amplify-plugin.json                       |  28 ++--
 .../package.json                              |   1 +
 .../resources/overrides-resource/override.ts  |   6 +
 .../resources/overrides-resource/package.json |  18 +++
 .../overrides-resource/tsconfig.json          |  12 ++
 .../overrides-resource/tsconfig.resource.json |  13 ++
 .../commands/awscloudformation/override.ts    |  19 +++
 .../src/index.ts                              |   3 +
 .../src/override-manager/index.ts             |   1 +
 .../override-manager/transform-resource.ts    |  31 +++++
 .../src/utility-functions.js                  |  13 ++
 .../tsconfig.json                             |   1 +
 yarn.lock                                     |   2 +-
 37 files changed, 746 insertions(+), 20 deletions(-)
 create mode 100644 packages/amplify-cli-core/src/category-interfaces/amplify-base-cdk-types.ts
 create mode 100644 packages/amplify-cli-core/src/category-interfaces/category-base-schema-generator.ts
 create mode 100644 packages/amplify-cli-core/src/category-interfaces/category-input-state.ts
 create mode 100644 packages/amplify-cli-core/src/category-interfaces/category-override-base.ts
 create mode 100644 packages/amplify-cli-core/src/category-interfaces/index.ts
 create mode 100644 packages/amplify-cli-core/src/overrides-manager/index.ts
 create mode 100644 packages/amplify-cli-core/src/overrides-manager/override-skeleton-generator.ts
 create mode 100644 packages/amplify-cli-overrides-helper/.npmignore
 create mode 100644 packages/amplify-cli-overrides-helper/CHANGELOG.md
 create mode 100644 packages/amplify-cli-overrides-helper/README.md
 create mode 100644 packages/amplify-cli-overrides-helper/package.json
 create mode 100644 packages/amplify-cli-overrides-helper/src/index.ts
 create mode 100644 packages/amplify-cli-overrides-helper/tsconfig.json
 create mode 100644 packages/amplify-cli/src/__tests__/commands/build-override.test.ts
 create mode 100644 packages/amplify-cli/src/commands/build-override.ts
 create mode 100644 packages/amplify-provider-awscloudformation/resources/overrides-resource/override.ts
 create mode 100644 packages/amplify-provider-awscloudformation/resources/overrides-resource/package.json
 create mode 100644 packages/amplify-provider-awscloudformation/resources/overrides-resource/tsconfig.json
 create mode 100644 packages/amplify-provider-awscloudformation/resources/overrides-resource/tsconfig.resource.json
 create mode 100644 packages/amplify-provider-awscloudformation/src/commands/awscloudformation/override.ts
 create mode 100644 packages/amplify-provider-awscloudformation/src/override-manager/index.ts
 create mode 100644 packages/amplify-provider-awscloudformation/src/override-manager/transform-resource.ts

diff --git a/.eslintrc.js b/.eslintrc.js
index 092c091ea4a..89a006999ab 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -323,6 +323,7 @@ module.exports = {
     '/packages/amplify-graphql-*transformer*/lib',
     '/packages/amplify-provider-awscloudformation/lib',
     '/packages/amplify-console-integration-tests/lib',
+    '/packages/amplify-cli-overrides-helper/lib',
 
     // Ignore CHANGELOG.md files
     '/packages/*/CHANGELOG.md',
diff --git a/.gitignore b/.gitignore
index b2b840c431f..6b24ec226e4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -67,3 +67,5 @@ packages/**/reports/junit/*
 test.out.log
 *.tsbuildinfo
 packages/amplify-graphiql-explorer/.eslintcache
+packages/amplify-cli-overrides-helper/lib
+
diff --git a/packages/amplify-cli-core/src/category-interfaces/amplify-base-cdk-types.ts b/packages/amplify-cli-core/src/category-interfaces/amplify-base-cdk-types.ts
new file mode 100644
index 00000000000..8b85ac9ca2b
--- /dev/null
+++ b/packages/amplify-cli-core/src/category-interfaces/amplify-base-cdk-types.ts
@@ -0,0 +1,32 @@
+//Define all common classes and interfaces required to generate cloudformation using CDK.
+import * as cdk from '@aws-cdk/core';
+
+//Base template
+//Customer can use these params to mutate the Cloudformation for the resource
+export interface AmplifyStackTemplate {
+  addCfnParameter(props: cdk.CfnParameterProps, logicalId: string): void;
+  addCfnOutput(props: cdk.CfnOutputProps, logicalId: string): void;
+  addCfnMapping(props: cdk.CfnMappingProps, logicalId: string): void;
+  addCfnCondition(props: cdk.CfnConditionProps, logicalId: string): void;
+
+  getCfnParameter(logicalId: string): cdk.CfnParameter;
+  getCfnOutput(logicalId: string): cdk.CfnOutput;
+  getCfnMapping(logicalId: string): cdk.CfnMapping;
+  getCfnCondition(logicalId: string): cdk.CfnCondition;
+}
+
+export interface Template {
+  AWSTemplateFormatVersion?: string;
+  Description?: string;
+  Metadata?: Record<string, any>;
+  Parameters?: Record<string, any>;
+  Mappings?: {
+    [key: string]: {
+      [key: string]: Record<string, string | number | string[]>;
+    };
+  };
+  Conditions?: Record<string, any>;
+  Transform?: any;
+  Resources?: Record<string, any>;
+  Outputs?: Record<string, any>;
+}
diff --git a/packages/amplify-cli-core/src/category-interfaces/category-base-schema-generator.ts b/packages/amplify-cli-core/src/category-interfaces/category-base-schema-generator.ts
new file mode 100644
index 00000000000..1b1501860f8
--- /dev/null
+++ b/packages/amplify-cli-core/src/category-interfaces/category-base-schema-generator.ts
@@ -0,0 +1,123 @@
+/**
+ * Utility base classes for all categories : CLIInputSchemaGenerator
+ * Generates JSON-schema from Typescript structures.The generated schemas
+ * can be used for run-time validation of Walkthrough/Headless structures.
+ */
+import { getProgramFromFiles, buildGenerator, PartialArgs } from 'typescript-json-schema';
+import fs from 'fs-extra';
+import path from 'path';
+import Ajv from 'ajv';
+import { printer } from 'amplify-prompts';
+
+// Interface types are expected to be exported as "typeName" in the file
+export type TypeDef = {
+  typeName: string;
+  service: string;
+};
+
+export class CLIInputSchemaGenerator {
+  // Paths are relative to the package root
+  TYPES_SRC_ROOT = './src/provider-utils/awscloudformation/service-walkthrough-types/';
+  SCHEMA_FILES_ROOT = './resources/schemas';
+  OVERWRITE_SCHEMA_FLAG = '--overwrite';
+
+  private serviceTypeDefs: TypeDef[];
+
+  private getSchemaFileNameForType(typeName: string): string {
+    return `${typeName}.schema.json`;
+  }
+
+  private getTypesSrcRootForSvc(svcName: string): string {
+    return `${this.TYPES_SRC_ROOT}/${svcName}-user-input-types.ts`;
+  }
+
+  private getSvcFileAbsolutePath(svcName: string): string {
+    return path.resolve(this.getTypesSrcRootForSvc(svcName));
+  }
+
+  private printWarningSchemaFileExists() {
+    printer.info('The interface version must be bumped after any changes.');
+    printer.info(`Use the ${this.OVERWRITE_SCHEMA_FLAG} flag to overwrite existing versions`);
+    printer.info('Skipping this schema');
+  }
+
+  private printSuccessSchemaFileWritten(typeName: string) {
+    printer.info(`Schema written for type ${typeName}.`);
+  }
+
+  constructor(typeDefs: TypeDef[]) {
+    this.serviceTypeDefs = typeDefs;
+  }
+
+  public generateJSONSchemas(): string[] {
+    const force = process.argv.includes(this.OVERWRITE_SCHEMA_FLAG);
+    const generatedFilePaths: string[] = [];
+
+    // schema generation settings. see https://www.npmjs.com/package/typescript-json-schema#command-line
+    const settings: PartialArgs = {
+      required: true,
+    };
+
+    for (const typeDef of this.serviceTypeDefs) {
+      //get absolute file path to the user-input types for the given service
+      const svcAbsoluteFilePath = this.getSvcFileAbsolutePath(typeDef.service);
+      printer.info(svcAbsoluteFilePath);
+      //generate json-schema from the input-types
+      const typeSchema = buildGenerator(getProgramFromFiles([svcAbsoluteFilePath]), settings)?.getSchemaForSymbol(typeDef.typeName);
+      //save json-schema file for the input-types. (used to validate cli-inputs.json)
+      const outputSchemaFilePath = path.resolve(
+        path.join(this.SCHEMA_FILES_ROOT, typeDef.service, this.getSchemaFileNameForType(typeDef.typeName)),
+      );
+      if (!force && fs.existsSync(outputSchemaFilePath)) {
+        this.printWarningSchemaFileExists();
+        return generatedFilePaths;
+      }
+      fs.ensureFileSync(outputSchemaFilePath);
+      fs.writeFileSync(outputSchemaFilePath, JSON.stringify(typeSchema, undefined, 4));
+      //print success status to the terminal
+      this.printSuccessSchemaFileWritten(typeDef.typeName);
+      generatedFilePaths.push(outputSchemaFilePath);
+    }
+    return generatedFilePaths;
+  }
+}
+
+//Read Schema, Validate and return Typescript object.
+export class CLIInputSchemaValidator {
+  _category: string;
+  _service: string;
+  _schemaFileName: string;
+  _ajv: Ajv.Ajv;
+
+  constructor(service: string, category: string, schemaFileName: string) {
+    this._category = category;
+    this._service = service;
+    this._schemaFileName = schemaFileName;
+    this._ajv = new Ajv();
+  }
+
+  async getUserInputSchema() {
+    try {
+      return await import(generateSchemaPath(this._category, this._service, this._schemaFileName));
+    } catch (ex) {
+      throw new Error(`Schema defination doesnt exist : ${generateSchemaPath(this._category, this._service, this._schemaFileName)}`);
+    }
+  }
+
+  async validateInput(userInput: string): Promise<boolean> {
+    const userInputSchema = await this.getUserInputSchema();
+    if (userInputSchema.dependencySchemas) {
+      userInputSchema.dependencySchemas.reduce((acc: { addSchema: (arg0: any) => any }, it: any) => acc.addSchema(it), this._ajv);
+    }
+    const validate = this._ajv.compile(userInputSchema);
+    const input = JSON.parse(userInput);
+    if (!validate(input) as boolean) {
+      throw new Error(`Data did not validate against the supplied schema. Underlying errors were ${JSON.stringify(validate.errors)}`);
+    }
+    return true;
+  }
+}
+
+const generateSchemaPath = (category: string, service: string, schemaFileName: string): string => {
+  return path.join(`@aws-amplify/amplify-category-${category}`, 'resources', 'schemas', `${service}`, `${schemaFileName}.schema.json`);
+};
diff --git a/packages/amplify-cli-core/src/category-interfaces/category-input-state.ts b/packages/amplify-cli-core/src/category-interfaces/category-input-state.ts
new file mode 100644
index 00000000000..34dcc9fb89c
--- /dev/null
+++ b/packages/amplify-cli-core/src/category-interfaces/category-input-state.ts
@@ -0,0 +1,12 @@
+import { $TSAny } from '..';
+
+export abstract class CategoryInputState {
+  _resourceName: string;
+  constructor(resourceName: string) {
+    this._resourceName = resourceName;
+  }
+
+  abstract getCLIInputPayload(): $TSAny;
+  abstract saveCLIInputPayload(props: $TSAny): void;
+  abstract isCLIInputsValid(props: $TSAny): void;
+}
diff --git a/packages/amplify-cli-core/src/category-interfaces/category-override-base.ts b/packages/amplify-cli-core/src/category-interfaces/category-override-base.ts
new file mode 100644
index 00000000000..58f40effbdf
--- /dev/null
+++ b/packages/amplify-cli-core/src/category-interfaces/category-override-base.ts
@@ -0,0 +1,24 @@
+import { $TSContext } from '..';
+import { Template } from './amplify-base-cdk-types';
+
+export abstract class AmplifyCategoryTransform {
+  _resourceName: string;
+  constructor(resourceName: string) {
+    this._resourceName = resourceName;
+  }
+  /**
+   * Entry point for CFN transformation process for a category
+   * @param context
+   */
+  abstract transform(context: $TSContext): Promise<Template>;
+  /**
+   * Apply overrides on the derviced class object
+   */
+  abstract applyOverride(): Promise<void>;
+  /**
+   * This function build and write  CFN files and parameters.json to disk
+   * @param context amplify context
+   * @param template Amplify generated CFN template
+   */
+  abstract saveBuildFiles(context: $TSContext, template: Template): Promise<void>;
+}
diff --git a/packages/amplify-cli-core/src/category-interfaces/index.ts b/packages/amplify-cli-core/src/category-interfaces/index.ts
new file mode 100644
index 00000000000..c0de6c25ead
--- /dev/null
+++ b/packages/amplify-cli-core/src/category-interfaces/index.ts
@@ -0,0 +1,4 @@
+export * from './amplify-base-cdk-types';
+export * from './category-override-base';
+export * from './category-base-schema-generator';
+export * from './category-input-state';
diff --git a/packages/amplify-cli-core/src/cliConstants.ts b/packages/amplify-cli-core/src/cliConstants.ts
index 19970cf5c3c..e60538dfdac 100644
--- a/packages/amplify-cli-core/src/cliConstants.ts
+++ b/packages/amplify-cli-core/src/cliConstants.ts
@@ -1 +1,35 @@
 export const SecretFileMode = 0o600; //file permissions for -rw-------
+export const CLISubCommands = {
+  ADD: 'add',
+  PUSH: 'push',
+  PULL: 'pull',
+  REMOVE: 'remove',
+  UPDATE: 'update',
+  CONSOLE: 'console',
+  IMPORT: 'import',
+};
+export const AmplifyCategories = {
+  STORAGE: 'storage',
+  API: 'api',
+  AUTH: 'auth',
+  FUNCTION: 'function',
+  HOSTING: 'hosting',
+  INTERACTIONS: 'interactions',
+  NOTIFICATIONS: 'notifications',
+  PREDICTIONS: 'predictions',
+  ANALYTICS: 'analytics',
+};
+
+export const AmplifySupportedService = {
+  S3: 'S3',
+  DYNAMODB: 'DynamoDB',
+  COGNITO: 'Cognito',
+};
+
+export const overriddenCategories = [AmplifyCategories.AUTH];
+
+export type IAmplifyResource = {
+  category: string;
+  resourceName: string;
+  service: string;
+};
diff --git a/packages/amplify-cli-core/src/feature-flags/featureFlags.ts b/packages/amplify-cli-core/src/feature-flags/featureFlags.ts
index 88194256519..39ea9488611 100644
--- a/packages/amplify-cli-core/src/feature-flags/featureFlags.ts
+++ b/packages/amplify-cli-core/src/feature-flags/featureFlags.ts
@@ -699,5 +699,21 @@ export class FeatureFlags {
         defaultValueForNewProjects: 1,
       },
     ]);
+
+    // FF for overrides
+    this.registerFlag('overrides', [
+      {
+        name: 'auth',
+        type: 'boolean',
+        defaultValueForExistingProjects: false,
+        defaultValueForNewProjects: false,
+      },
+      {
+        name: 'project',
+        type: 'boolean',
+        defaultValueForExistingProjects: false,
+        defaultValueForNewProjects: false,
+      },
+    ]);
   };
 }
diff --git a/packages/amplify-cli-core/src/index.ts b/packages/amplify-cli-core/src/index.ts
index 3051364baa7..fc553384915 100644
--- a/packages/amplify-cli-core/src/index.ts
+++ b/packages/amplify-cli-core/src/index.ts
@@ -23,7 +23,10 @@ export * from './banner-message';
 export * from './cliGetCategories';
 export * from './cliRemoveResourcePrompt';
 export * from './cliViewAPI';
+export * from './overrides-manager';
 export * from './hooks';
+export * from './cliConstants';
+export * from './category-interfaces';
 
 // Temporary types until we can finish full type definition across the whole CLI
 
diff --git a/packages/amplify-cli-core/src/overrides-manager/index.ts b/packages/amplify-cli-core/src/overrides-manager/index.ts
new file mode 100644
index 00000000000..cef965a6b17
--- /dev/null
+++ b/packages/amplify-cli-core/src/overrides-manager/index.ts
@@ -0,0 +1 @@
+export * from './override-skeleton-generator';
diff --git a/packages/amplify-cli-core/src/overrides-manager/override-skeleton-generator.ts b/packages/amplify-cli-core/src/overrides-manager/override-skeleton-generator.ts
new file mode 100644
index 00000000000..dce84ee061d
--- /dev/null
+++ b/packages/amplify-cli-core/src/overrides-manager/override-skeleton-generator.ts
@@ -0,0 +1,81 @@
+import fs from 'fs-extra';
+import { $TSContext, getPackageManager } from '../index';
+import execa from 'execa';
+import * as path from 'path';
+import { printer } from 'amplify-prompts';
+import { JSONUtilities } from '../jsonUtilities';
+
+export const generateOverrideSkeleton = async (context: $TSContext, srcResourceDirPath: string, destDirPath: string): Promise<void> => {
+  // 1. Create skeleton package
+  const backendDir = context.amplify.pathManager.getBackendDirPath();
+  const overrideFile = path.join(destDirPath, 'override.ts');
+  if (fs.existsSync(overrideFile)) {
+    await context.amplify.openEditor(context, overrideFile);
+    return;
+  }
+  // add tsConfig and package.json to amplify/backend
+  generateAmplifyOverrideProjectBuildFiles(backendDir, srcResourceDirPath);
+
+  fs.ensureDirSync(destDirPath);
+
+  // add overrde.ts and tsconfig<project> to build folder of the resource / rootstack
+  generateTsConfigforProject(backendDir, srcResourceDirPath, destDirPath);
+
+  // 2. Build Override Directory
+  await buildOverrideDir(backendDir, destDirPath);
+
+  printer.success(`Successfully generated "override.ts" folder at ${destDirPath}`);
+  await context.amplify.openEditor(context, overrideFile);
+};
+
+export async function buildOverrideDir(cwd: string, destDirPath: string) {
+  const packageManager = getPackageManager(cwd);
+
+  if (packageManager === null) {
+    throw new Error('No package manager found. Please install npm or yarn to compile overrides for this project.');
+  }
+
+  try {
+    execa.sync(packageManager.executable, ['install'], {
+      cwd,
+      stdio: 'pipe',
+      encoding: 'utf-8',
+    });
+  } catch (error) {
+    if ((error as any).code === 'ENOENT') {
+      throw new Error(`Packaging overrides failed. Could not find ${packageManager} executable in the PATH.`);
+    } else {
+      throw new Error(`Packaging overrides failed with the error \n${error.message}`);
+    }
+  }
+
+  // run tsc build to build override.ts file
+  const tsConfigDir = path.join(destDirPath, 'build');
+  const tsConfigFilePath = path.join(tsConfigDir, 'tsconfig.resource.json');
+  execa.sync('tsc', [`--project`, `${tsConfigFilePath}`], {
+    cwd: tsConfigDir,
+    stdio: 'pipe',
+    encoding: 'utf-8',
+  });
+}
+
+export const generateAmplifyOverrideProjectBuildFiles = (backendDir: string, srcResourceDirPath: string) => {
+  const packageJSONFilePath = path.join(backendDir, 'package.json');
+  const tsConfigFilePath = path.join(backendDir, 'tsconfig.json');
+  // add package.json to amplofy backend
+  if (!fs.existsSync(packageJSONFilePath)) {
+    JSONUtilities.writeJson(packageJSONFilePath, JSONUtilities.readJson(path.join(srcResourceDirPath, 'package.json')));
+  }
+
+  // add tsConfig.json to amplify backend
+  if (!fs.existsSync(tsConfigFilePath)) {
+    JSONUtilities.writeJson(tsConfigFilePath, JSONUtilities.readJson(path.join(srcResourceDirPath, 'tsconfig.json')));
+  }
+};
+
+export const generateTsConfigforProject = (backendDir: string, srcResourceDirPath: string, destDirPath: string) => {
+  const overrideFileName = path.join(destDirPath, 'override.ts');
+  const resourceTsConfigFileName = path.join(destDirPath, 'build', 'tsconfig.resource.json');
+  fs.writeFileSync(overrideFileName, fs.readFileSync(path.join(srcResourceDirPath, 'override.ts')));
+  fs.writeFileSync(resourceTsConfigFileName, fs.readFileSync(path.join(srcResourceDirPath, 'tsconfig.resource.json')));
+};
diff --git a/packages/amplify-cli-core/src/state-manager/pathManager.ts b/packages/amplify-cli-core/src/state-manager/pathManager.ts
index 8a703b4c3dc..53c88f1b4ec 100644
--- a/packages/amplify-cli-core/src/state-manager/pathManager.ts
+++ b/packages/amplify-cli-core/src/state-manager/pathManager.ts
@@ -21,6 +21,11 @@ export const PathConstants = {
   CurrentCloudBackendDirName: '#current-cloud-backend',
   HooksDirName: 'hooks',
 
+  // 2nd Level
+  OverrideDirName: 'overrides',
+  ProviderName: 'awscloudformation',
+  CfnStacksBuildDirName: 'build',
+
   // FileNames
   AmplifyAdminConfigFileName: 'config.json',
 
@@ -36,6 +41,7 @@ export const PathConstants = {
   HooksShellSampleFileName: 'post-push.sh.sample',
   HooksJsSampleFileName: 'pre-push.js.sample',
   HooksReadmeFileName: 'hooks-readme.md',
+  OverrideFileName: 'override.ts',
 
   LocalEnvFileName: 'local-env-info.json',
   LocalAWSInfoFileName: 'local-aws-info.json',
@@ -168,6 +174,43 @@ export class PathManager {
   getHooksConfigFilePath = (projectPath?: string): string =>
     path.join(this.getHooksDirPath(projectPath), PathConstants.HooksConfigFileName);
 
+  getOverrideDirPath = (projectPath: string, category: string, resourceName: string): string => {
+    return this.constructPath(projectPath, [
+      PathConstants.AmplifyDirName,
+      PathConstants.BackendDirName,
+      category,
+      resourceName,
+      PathConstants.OverrideDirName,
+    ]);
+  };
+
+  getRootOverrideDirPath = (projectPath: string): string => {
+    return this.constructPath(projectPath, [
+      PathConstants.AmplifyDirName,
+      PathConstants.BackendDirName,
+      PathConstants.ProviderName,
+      PathConstants.OverrideDirName,
+    ]);
+  };
+
+  getRootStackDirPath = (projectPath: string): string => {
+    return this.constructPath(projectPath, [
+      PathConstants.AmplifyDirName,
+      PathConstants.BackendDirName,
+      PathConstants.ProviderName,
+      PathConstants.CfnStacksBuildDirName,
+    ]);
+  };
+
+  getCurrentCloudRootStackDirPath = (projectPath: string): string => {
+    return this.constructPath(projectPath, [
+      PathConstants.AmplifyDirName,
+      PathConstants.CurrentCloudBackendDirName,
+      PathConstants.ProviderName,
+      PathConstants.CfnStacksBuildDirName,
+    ]);
+  };
+
   private constructPath = (projectPath?: string, segments: string[] = []): string => {
     if (!projectPath) {
       projectPath = this.findProjectRoot();
diff --git a/packages/amplify-cli-overrides-helper/.npmignore b/packages/amplify-cli-overrides-helper/.npmignore
new file mode 100644
index 00000000000..3ee5d55b0b8
--- /dev/null
+++ b/packages/amplify-cli-overrides-helper/.npmignore
@@ -0,0 +1,5 @@
+**/__mocks__/**
+**/__tests__/**
+src
+tsconfig.json
+tsconfig.tsbuildinfo
diff --git a/packages/amplify-cli-overrides-helper/CHANGELOG.md b/packages/amplify-cli-overrides-helper/CHANGELOG.md
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/packages/amplify-cli-overrides-helper/README.md b/packages/amplify-cli-overrides-helper/README.md
new file mode 100644
index 00000000000..c8c495d77b7
--- /dev/null
+++ b/packages/amplify-cli-overrides-helper/README.md
@@ -0,0 +1 @@
+EMPTY SKELETON FOR NOW.
diff --git a/packages/amplify-cli-overrides-helper/package.json b/packages/amplify-cli-overrides-helper/package.json
new file mode 100644
index 00000000000..ce1d0d9a90a
--- /dev/null
+++ b/packages/amplify-cli-overrides-helper/package.json
@@ -0,0 +1,48 @@
+{
+  "name": "@aws-amplify/cli-overrides-helper",
+  "version": "1.0.0",
+  "description": "Amplify CLI Overrides Helper utility package",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/aws-amplify/amplify-cli.git",
+    "directory": "packages/amplify-cli-overrides-helper"
+  },
+  "author": "Amazon Web Services",
+  "license": "Apache-2.0",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "keywords": [
+    "graphql",
+    "cli",
+    "cloudformation",
+    "aws",
+    "amplify"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "watch": "tsc -w",
+    "clean": "rimraf ./lib"
+  },
+  "dependencies": {
+    "amplify-prompts": "1.1.2"
+  },
+  "devDependencies": {},
+  "jest": {
+    "transform": {
+      "^.+\\.(ts|tsx)?$": "ts-jest"
+    },
+    "testRegex": "(src/__tests__/.*.test.ts)$",
+    "moduleFileExtensions": [
+      "ts",
+      "tsx",
+      "js",
+      "jsx",
+      "json",
+      "node"
+    ],
+    "collectCoverage": true
+  }
+}
\ No newline at end of file
diff --git a/packages/amplify-cli-overrides-helper/src/index.ts b/packages/amplify-cli-overrides-helper/src/index.ts
new file mode 100644
index 00000000000..950b9bab82b
--- /dev/null
+++ b/packages/amplify-cli-overrides-helper/src/index.ts
@@ -0,0 +1,13 @@
+import { printer } from 'amplify-prompts';
+
+function getProjectInfo(): void {
+  printer.info('Hello from the skeleton of get project info');
+  return;
+}
+
+function addDependency(): void {
+  printer.info('Hello from the skeleton of add dependency');
+  return;
+}
+
+export { getProjectInfo, addDependency };
diff --git a/packages/amplify-cli-overrides-helper/tsconfig.json b/packages/amplify-cli-overrides-helper/tsconfig.json
new file mode 100644
index 00000000000..4db720dc27c
--- /dev/null
+++ b/packages/amplify-cli-overrides-helper/tsconfig.json
@@ -0,0 +1,8 @@
+{
+    "extends": "../../tsconfig.base.json",
+    "compilerOptions": {
+      "outDir": "./lib",
+      "rootDir": "./src",
+    }
+  }
+  
\ No newline at end of file
diff --git a/packages/amplify-cli/src/__tests__/commands/build-override.test.ts b/packages/amplify-cli/src/__tests__/commands/build-override.test.ts
new file mode 100644
index 00000000000..92d8d7d0223
--- /dev/null
+++ b/packages/amplify-cli/src/__tests__/commands/build-override.test.ts
@@ -0,0 +1,65 @@
+import { run } from '../../commands/build-override';
+import { $TSContext } from 'amplify-cli-core';
+
+jest.mock('amplify-cli-core');
+jest.mock('amplify-provider-awscloudformation');
+
+describe('run build-override command', () => {
+  it('runs command successfully', async () => {
+    const context_stub = {
+      amplify: {
+        getResourceStatus: jest.fn().mockResolvedValue({
+          resourcesToBeCreated: [
+            {
+              category: 'mockcategory1',
+              service: 'mockservice1',
+              resourceName: 'mockResourceName1',
+            },
+            {
+              category: 'mockcategory2',
+              service: 'mockservice2',
+              resourceName: 'mockResourceName2',
+            },
+          ],
+          resourcesToBeUpdated: [
+            {
+              category: 'mockcategory3',
+              service: 'mockservice3',
+              resourceName: 'mockResourceName3',
+            },
+            {
+              category: 'mockcategory4',
+              service: 'mockservice4',
+              resourceName: 'mockResourceName4',
+            },
+          ],
+        }),
+
+        confirmPrompt: jest.fn().mockResolvedValue(true),
+        invokePluginMethod: jest.fn(),
+      },
+    };
+
+    const context_stub_typed = context_stub as unknown as $TSContext;
+    await run(context_stub_typed);
+    expect(context_stub_typed.amplify.invokePluginMethod).toBeCalledTimes(4);
+  });
+
+  it('runs command successfully empty Arrays', async () => {
+    jest.clearAllMocks();
+    const context_stub = {
+      amplify: {
+        getResourceStatus: jest.fn().mockResolvedValue({
+          resourcesToBeCreated: [],
+          resourcesToBeUpdated: [],
+        }),
+
+        confirmPrompt: jest.fn().mockResolvedValue(true),
+      },
+    };
+
+    const context_stub_typed = context_stub as unknown as $TSContext;
+    await run(context_stub_typed);
+    expect(context_stub_typed.amplify.invokePluginMethod).toBeUndefined();
+  });
+});
diff --git a/packages/amplify-cli/src/commands/build-override.ts b/packages/amplify-cli/src/commands/build-override.ts
new file mode 100644
index 00000000000..05b0dc4fa7a
--- /dev/null
+++ b/packages/amplify-cli/src/commands/build-override.ts
@@ -0,0 +1,59 @@
+import { $TSContext, IAmplifyResource } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
+/**
+ * Command to transform CFN with overrides
+ */
+const subcommand = 'build-override';
+
+export const run = async (context: $TSContext) => {
+  let resourceName = context?.input?.subCommands?.[0];
+  const categoryName = context?.input?.subCommands?.[1];
+
+  if (categoryName === undefined) {
+    // if no category is mentioned , then defaults to all resource
+    resourceName = undefined;
+  }
+
+  try {
+    const resourcesToBuild: IAmplifyResource[] = await getResources(context);
+    let filteredResources = {};
+    if (categoryName) {
+      filteredResources = resourcesToBuild.filter(resource => resource.category === categoryName);
+    }
+    if (categoryName && resourceName) {
+      filteredResources = resourcesToBuild.filter(resource => resource.category === categoryName && resource.resourceName === resourceName);
+    }
+    for (const resource of resourcesToBuild) {
+      await context.amplify.invokePluginMethod(context, 'awscloudformation', undefined, 'transformResourceWithOverrides', [
+        context,
+        resource,
+      ]);
+    }
+  } catch (err) {
+    printer.error(err.stack);
+    printer.error('There was an error building the resource');
+    context.usageData.emitError(err);
+    process.exitCode = 1;
+  }
+};
+
+export const getResources = async (context: $TSContext): Promise<IAmplifyResource[]> => {
+  const resources: IAmplifyResource[] = [];
+  const { resourcesToBeCreated, resourcesToBeUpdated } = await context.amplify.getResourceStatus();
+  resourcesToBeCreated.forEach(resourceCreated => {
+    resources.push({
+      service: resourceCreated.service as string,
+      category: resourceCreated.category as string,
+      resourceName: resourceCreated.resourceName as string,
+    });
+  });
+
+  resourcesToBeUpdated.forEach(resourceUpdated => {
+    resources.push({
+      service: resourceUpdated.service as string,
+      category: resourceUpdated.category as string,
+      resourceName: resourceUpdated.resourceName as string,
+    });
+  });
+  return resources;
+};
diff --git a/packages/amplify-cli/src/execution-manager.ts b/packages/amplify-cli/src/execution-manager.ts
index f0a2e08d78c..bbeb69d1b8d 100644
--- a/packages/amplify-cli/src/execution-manager.ts
+++ b/packages/amplify-cli/src/execution-manager.ts
@@ -1,7 +1,7 @@
 import * as fs from 'fs-extra';
 import * as path from 'path';
 import * as inquirer from 'inquirer';
-import { $TSAny, stateManager, executeHooks, HooksMeta } from 'amplify-cli-core';
+import { FeatureFlags, stateManager, executeHooks, HooksMeta, overriddenCategories } from 'amplify-cli-core';
 import { twoStringSetsAreEqual, twoStringSetsAreDisjoint } from './utils/set-ops';
 import { Context } from './domain/context';
 import { constants } from './domain/constants';
@@ -39,6 +39,32 @@ export function isContainersEnabled(context) {
 }
 
 async function selectPluginForExecution(context: Context, pluginCandidates: PluginInfo[]): Promise<PluginInfo> {
+  const pluginCandidatesCategorySet = new Set<string>();
+
+  pluginCandidates.forEach(plugin => {
+    pluginCandidatesCategorySet.add(plugin.manifest.name);
+  });
+
+  // overrided packageName format : @aws-amplify/amplify-category-<catgoryName>
+  const pluginName = pluginCandidatesCategorySet.values().next().value;
+  if (pluginCandidatesCategorySet.size == 1 && overriddenCategories.includes(pluginName)) {
+    if (FeatureFlags.getBoolean(`overrides.${pluginName}`)) {
+      const pluginWithOverrides = pluginCandidates.find(plugin => {
+        return plugin.packageName === `@aws-amplify/amplify-category-${pluginName}`;
+      });
+      if (pluginWithOverrides !== undefined) {
+        return pluginWithOverrides;
+      }
+    } else {
+      const pluginWithOutOverrides = pluginCandidates.find(plugin => {
+        return plugin.packageName === `amplify-category-${pluginName}`;
+      });
+      if (pluginCandidates.length === 2 && pluginWithOutOverrides !== undefined) {
+        return pluginWithOutOverrides;
+      }
+    }
+  }
+
   let result = pluginCandidates[0];
 
   let promptForSelection = true;
diff --git a/packages/amplify-cli/src/extensions/amplify-helpers/get-category-pluginInfo.ts b/packages/amplify-cli/src/extensions/amplify-helpers/get-category-pluginInfo.ts
index 3676a2599d7..8906d3c4913 100644
--- a/packages/amplify-cli/src/extensions/amplify-helpers/get-category-pluginInfo.ts
+++ b/packages/amplify-cli/src/extensions/amplify-helpers/get-category-pluginInfo.ts
@@ -1,3 +1,5 @@
+import { FeatureFlags } from 'amplify-cli-core';
+
 export function getCategoryPluginInfo(context, category, service?) {
   let categoryPluginInfo;
 
@@ -15,6 +17,12 @@ export function getCategoryPluginInfo(context, category, service?) {
         categoryPluginInfo = pluginInfosForCategory[0];
       }
     } else {
+      const overidedPlugin = pluginInfosForCategory.find(plugin => {
+        return plugin.packageName === `@aws-amplify/amplify-category-${category}` && FeatureFlags.getBoolean(`overrides.${category}`);
+      });
+      if (overidedPlugin !== undefined) {
+        return overidedPlugin;
+      }
       categoryPluginInfo = pluginInfosForCategory[0];
     }
   }
diff --git a/packages/amplify-cli/src/extensions/amplify-helpers/push-resources.ts b/packages/amplify-cli/src/extensions/amplify-helpers/push-resources.ts
index 4e71549cc77..efb5fa488a7 100644
--- a/packages/amplify-cli/src/extensions/amplify-helpers/push-resources.ts
+++ b/packages/amplify-cli/src/extensions/amplify-helpers/push-resources.ts
@@ -4,7 +4,8 @@ import { onCategoryOutputsChange } from './on-category-outputs-change';
 import { initializeEnv } from '../../initialize-env';
 import { getProviderPlugins } from './get-provider-plugins';
 import { getEnvInfo } from './get-env-info';
-import { EnvironmentDoesNotExistError, exitOnNextTick, stateManager, $TSAny, $TSContext } from 'amplify-cli-core';
+import { EnvironmentDoesNotExistError, exitOnNextTick, stateManager, $TSAny, $TSContext, IAmplifyResource } from 'amplify-cli-core';
+import { getResources } from '../../commands/build-override';
 
 export async function pushResources(
   context: $TSContext,
@@ -49,6 +50,10 @@ export async function pushResources(
     }
   }
 
+  // building all CFN stacks here to get the resource Changes
+  const resourcesToBuild: IAmplifyResource[] = await getResources(context);
+  context.amplify.executeProviderUtils(context, 'awscloudformation', 'buildOverrides', { resourcesToBuild, forceCompile: true });
+
   const hasChanges = await showResourceTable(category, resourceName, filteredResources);
 
   // no changes detected
diff --git a/packages/amplify-provider-awscloudformation/amplify-plugin.json b/packages/amplify-provider-awscloudformation/amplify-plugin.json
index eda589a8644..618886f0046 100644
--- a/packages/amplify-provider-awscloudformation/amplify-plugin.json
+++ b/packages/amplify-provider-awscloudformation/amplify-plugin.json
@@ -1,18 +1,12 @@
 {
-    "name": "awscloudformation",
-    "aliases": ["awscfn", "aws"],
-    "type": "provider",
-    "commands": [
-        "configure",
-        "console",
-        "reset-cache",
-        "setupNewUser",
-        "help"
-    ],
-    "commandAliases":{
-        "resetCache": "reset-cache",
-        "setup-new-user": "setupNewUser",
-        "newUser": "setupNewUser",
-        "new-user": "setupNewUser"
-    }
-}
\ No newline at end of file
+  "name": "awscloudformation",
+  "aliases": ["awscfn", "aws", "root"],
+  "type": "provider",
+  "commands": ["configure", "console", "reset-cache", "setupNewUser", "help", "override"],
+  "commandAliases": {
+    "resetCache": "reset-cache",
+    "setup-new-user": "setupNewUser",
+    "newUser": "setupNewUser",
+    "new-user": "setupNewUser"
+  }
+}
diff --git a/packages/amplify-provider-awscloudformation/package.json b/packages/amplify-provider-awscloudformation/package.json
index 0b8f55856a3..7cc530a9c1e 100644
--- a/packages/amplify-provider-awscloudformation/package.json
+++ b/packages/amplify-provider-awscloudformation/package.json
@@ -87,6 +87,7 @@
     "constructs": "^3.3.125",
     "cors": "^2.8.5",
     "deep-diff": "^1.0.2",
+    "execa": "^4.1.0",
     "extract-zip": "^2.0.1",
     "folder-hash": "^4.0.1",
     "fs-extra": "^8.1.0",
diff --git a/packages/amplify-provider-awscloudformation/resources/overrides-resource/override.ts b/packages/amplify-provider-awscloudformation/resources/overrides-resource/override.ts
new file mode 100644
index 00000000000..c02cee5ebd4
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/resources/overrides-resource/override.ts
@@ -0,0 +1,6 @@
+/* Add Amplify Helper dependencies     */
+
+/* TODO: Need to change props to Root-Stack specific props when props are ready */
+export function overrideProps(props: any): void {
+  /* TODO: Add snippet of how to override in comments */
+}
diff --git a/packages/amplify-provider-awscloudformation/resources/overrides-resource/package.json b/packages/amplify-provider-awscloudformation/resources/overrides-resource/package.json
new file mode 100644
index 00000000000..1601dccfc02
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/resources/overrides-resource/package.json
@@ -0,0 +1,18 @@
+{
+    "name": "overrides-for-root-stack",
+    "version": "1.0.0",
+    "description": "",
+    "scripts": {
+      "build": "tsc",
+      "watch": "tsc -w",
+      "test": "echo \"Error: no test specified\" && exit 1"
+    },
+    "dependencies": {
+      "@types/fs-extra": "^9.0.11",
+      "fs-extra": "^9.1.0"
+    },
+    "devDependencies": {
+      "typescript": "^4.2.4"
+    }
+  }
+  
\ No newline at end of file
diff --git a/packages/amplify-provider-awscloudformation/resources/overrides-resource/tsconfig.json b/packages/amplify-provider-awscloudformation/resources/overrides-resource/tsconfig.json
new file mode 100644
index 00000000000..f48614cbf6b
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/resources/overrides-resource/tsconfig.json
@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "es6",
+    "module": "commonjs",
+    "strict": false, 
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "outDir": "build"
+  }
+}
+  
\ No newline at end of file
diff --git a/packages/amplify-provider-awscloudformation/resources/overrides-resource/tsconfig.resource.json b/packages/amplify-provider-awscloudformation/resources/overrides-resource/tsconfig.resource.json
new file mode 100644
index 00000000000..6504da80283
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/resources/overrides-resource/tsconfig.resource.json
@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "es6",
+    "module": "commonjs",
+    "strict": false,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "outDir": "./",
+    "rootDir": "../"
+  },
+  "include": ["../**/*"]
+}
diff --git a/packages/amplify-provider-awscloudformation/src/commands/awscloudformation/override.ts b/packages/amplify-provider-awscloudformation/src/commands/awscloudformation/override.ts
new file mode 100644
index 00000000000..d504f9f0390
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/commands/awscloudformation/override.ts
@@ -0,0 +1,19 @@
+/*
+    entry code for amplify override root
+*/
+
+import path from 'path';
+import { generateOverrideSkeleton, $TSContext } from 'amplify-cli-core';
+
+const subcommand = 'override';
+
+export const name = 'overrides';
+
+export const run = async (context: $TSContext) => {
+  const backendDir = context.amplify.pathManager.getBackendDirPath();
+
+  const destPath = path.normalize(path.join(backendDir, 'awscloudformation'));
+  const srcPath = path.normalize(path.join(__dirname, '..', '..', '..', 'resources', 'overrides-resource'));
+
+  await generateOverrideSkeleton(context, srcPath, destPath);
+};
diff --git a/packages/amplify-provider-awscloudformation/src/index.ts b/packages/amplify-provider-awscloudformation/src/index.ts
index 1c5e68714f8..eca6984e9fa 100644
--- a/packages/amplify-provider-awscloudformation/src/index.ts
+++ b/packages/amplify-provider-awscloudformation/src/index.ts
@@ -36,6 +36,8 @@ import { updateEnv } from './update-env';
 
 import { uploadHooksDirectory } from './utils/hooks-manager';
 
+import { transformResourceWithOverrides } from './override-manager';
+
 function init(context) {
   return initializer.run(context);
 }
@@ -159,4 +161,5 @@ module.exports = {
   getConfiguredSSMClient,
   updateEnv,
   uploadHooksDirectory,
+  transformResourceWithOverrides,
 };
diff --git a/packages/amplify-provider-awscloudformation/src/override-manager/index.ts b/packages/amplify-provider-awscloudformation/src/override-manager/index.ts
new file mode 100644
index 00000000000..d2520bd864f
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/override-manager/index.ts
@@ -0,0 +1 @@
+export * from './transform-resource';
diff --git a/packages/amplify-provider-awscloudformation/src/override-manager/transform-resource.ts b/packages/amplify-provider-awscloudformation/src/override-manager/transform-resource.ts
new file mode 100644
index 00000000000..ab370daa7c6
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/override-manager/transform-resource.ts
@@ -0,0 +1,31 @@
+import { $TSContext, FeatureFlags, IAmplifyResource } from 'amplify-cli-core';
+//import { transformRootStack } from '.';
+import { printer } from 'amplify-prompts';
+/**
+ *
+ * @param context
+ * @returns
+ */
+export async function transformResourceWithOverrides(context: $TSContext, resource?: IAmplifyResource) {
+  const flags = context.parameters.options;
+  if (flags['no-override']) {
+    return;
+  }
+  if (resource && FeatureFlags.getBoolean(`overrides.${resource.category}`)) {
+    try {
+      // Each Category will implement transformCategoryStack function to start transformation process
+      const { transformCategoryStack } = await import(`@aws-amplify/amplify-category-${resource.category}`);
+      if (transformCategoryStack) {
+        return transformCategoryStack(context, resource);
+      } else {
+        printer.info('Overrides functionality is not impleented for this category');
+      }
+    } catch (err) {
+      return;
+    }
+  } else {
+    if (FeatureFlags.getBoolean('overrides.project')) {
+      //await transformRootStack(context);
+    }
+  }
+}
diff --git a/packages/amplify-provider-awscloudformation/src/utility-functions.js b/packages/amplify-provider-awscloudformation/src/utility-functions.js
index 03c6e69b7e1..5c3adb8141b 100644
--- a/packages/amplify-provider-awscloudformation/src/utility-functions.js
+++ b/packages/amplify-provider-awscloudformation/src/utility-functions.js
@@ -6,6 +6,8 @@ const { Lex } = require('./aws-utils/aws-lex');
 const Polly = require('./aws-utils/aws-polly');
 const SageMaker = require('./aws-utils/aws-sagemaker');
 const { transformGraphQLSchema, getDirectiveDefinitions } = require('./transform-graphql-schema');
+const { transformResourceWithOverrides } = require('./override-manager');
+
 const { updateStackForAPIMigration } = require('./push-resources');
 const SecretsManager = require('./aws-utils/aws-secretsmanager');
 const Route53 = require('./aws-utils/aws-route53');
@@ -60,6 +62,17 @@ module.exports = {
 
     return transformGraphQLSchema(context, optionsWithUpdateHandler);
   },
+
+  /**
+   * Utility function to build resource CFN with overrides
+   * Resources to build are passed with options
+   */
+  buildOverrides: async (context, options) => {
+    for (const resource of options.resourcesToBuild) {
+      await transformResourceWithOverrides(context, resource);
+    }
+  },
+
   newSecret: async (context, options) => {
     const { description, secret, name, version } = options;
     const client = await new SecretsManager(context);
diff --git a/packages/amplify-provider-awscloudformation/tsconfig.json b/packages/amplify-provider-awscloudformation/tsconfig.json
index 534ac673e77..bd94f6b3e9f 100644
--- a/packages/amplify-provider-awscloudformation/tsconfig.json
+++ b/packages/amplify-provider-awscloudformation/tsconfig.json
@@ -12,6 +12,7 @@
     "lib",
     "coverage",
     "src/__tests__",
+    "resources/overrides-resource/override.ts"
   ],
   "references": [
     {"path": "../amplify-cli-core"},
diff --git a/yarn.lock b/yarn.lock
index f72c0ce8cbd..a16099d8dc9 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -11351,7 +11351,7 @@ execa@^1.0.0:
     signal-exit "^3.0.0"
     strip-eof "^1.0.0"
 
-execa@^4.0.0:
+execa@^4.0.0, execa@^4.1.0:
   version "4.1.0"
   resolved "https://registry.yarnpkg.com/execa/-/execa-4.1.0.tgz#4e5491ad1572f2f17a77d388c6c857135b22847a"
   integrity sha512-j5W0//W7f8UxAn8hXVnwG8tLwdiUy4FJLcSupCg6maBYZDpyBvTApK7KyuI4bKj8KOh1r2YH+6ucuYtJv1bTZA==

From ee1c49e3ec976aae42ca00b48a6be7d2bd7a4b14 Mon Sep 17 00:00:00 2001
From: akshbhu <39866697+akshbhu@users.noreply.github.com>
Date: Tue, 28 Sep 2021 11:47:40 -0700
Subject: [PATCH 2/6] feat: root stack override (#8276)

* feat: added root stack transformation

* feat: adding root-stack-builder

* feat: added e2e and migration tests

* fix: minor fixes

* fix: fixes unit tests

* fix: address comments
---
 .circleci/config.base.yml                     |  24 ++
 .circleci/config.yml                          |  24 ++
 .../src/feature-flags/featureFlags.ts         |   4 +-
 .../override-skeleton-generator.ts            |  33 +-
 .../src/state-manager/pathManager.ts          |   2 +-
 .../amplify-cli-overrides-helper/package.json |   3 +-
 .../amplify-cli-overrides-helper/src/index.ts |   2 -
 .../tsconfig.json                             |   8 +-
 .../__tests__/commands/build-override.test.ts |  94 ++++-
 .../resource-status-diff.test.ts              | 323 ++++++++-------
 .../amplify-helpers/resource-status.test.ts   |  21 +
 .../src/commands/build-override.ts            |  18 +-
 .../amplify-helpers/resource-status-data.ts   | 105 ++---
 .../amplify-helpers/resource-status-diff.ts   | 367 +++++++++---------
 .../amplify-helpers/resource-status.ts        |  97 +++--
 .../amplify-helpers/root-stack-status.ts      |  35 ++
 .../amplify-e2e-core/src/init/amplifyPush.ts  |  29 +-
 packages/amplify-e2e-core/src/init/index.ts   |   1 +
 .../src/init/overrideRootStack.ts             |  19 +
 .../overrides/override-root.ts                |   4 +
 .../src/__tests__/init.test.ts                |  31 +-
 packages/amplify-migration-tests/package.json |   4 +-
 .../overrides/init-migration.test.ts          |  43 ++
 .../amplify-plugin.json                       |   2 +-
 .../src/__tests__/commands/override.test.ts   |  57 +++
 .../root-stack-builder.test.ts.snap           | 161 ++++++++
 .../root-stack-transform.test.ts.snap         | 151 +++++++
 .../root-stack-builder.test.ts                | 200 ++++++++++
 .../root-stack-transform.test.ts              |  22 ++
 .../src/attach-backend.js                     |   2 +-
 .../commands/awscloudformation/override.ts    |  29 +-
 .../src/index.ts                              |   7 +
 .../src/initializer.ts                        |  38 +-
 .../src/override-manager/index.ts             |  12 +
 .../override-manager/transform-resource.ts    |  19 +-
 .../src/push-resources.ts                     |  95 +++--
 .../src/root-stack-builder/index.ts           |   2 +
 .../root-stack-builder/root-stack-builder.ts  | 190 +++++++++
 .../root-stack-transform.ts                   | 215 ++++++++++
 .../root-stack-builder/stack-synthesizer.ts   |  45 +++
 .../src/root-stack-builder/types.ts           |  15 +
 .../src/utility-functions.js                  |   1 +
 42 files changed, 2035 insertions(+), 519 deletions(-)
 create mode 100644 packages/amplify-cli/src/extensions/amplify-helpers/root-stack-status.ts
 create mode 100644 packages/amplify-e2e-core/src/init/overrideRootStack.ts
 create mode 100644 packages/amplify-e2e-tests/overrides/override-root.ts
 create mode 100644 packages/amplify-migration-tests/src/__tests__/migration_tests/overrides/init-migration.test.ts
 create mode 100644 packages/amplify-provider-awscloudformation/src/__tests__/commands/override.test.ts
 create mode 100644 packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/__snapshots__/root-stack-builder.test.ts.snap
 create mode 100644 packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/__snapshots__/root-stack-transform.test.ts.snap
 create mode 100644 packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/root-stack-builder.test.ts
 create mode 100644 packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/root-stack-transform.test.ts
 create mode 100644 packages/amplify-provider-awscloudformation/src/root-stack-builder/index.ts
 create mode 100644 packages/amplify-provider-awscloudformation/src/root-stack-builder/root-stack-builder.ts
 create mode 100644 packages/amplify-provider-awscloudformation/src/root-stack-builder/root-stack-transform.ts
 create mode 100644 packages/amplify-provider-awscloudformation/src/root-stack-builder/stack-synthesizer.ts
 create mode 100644 packages/amplify-provider-awscloudformation/src/root-stack-builder/types.ts

diff --git a/.circleci/config.base.yml b/.circleci/config.base.yml
index 1bf9452036a..8d6e3366a09 100644
--- a/.circleci/config.base.yml
+++ b/.circleci/config.base.yml
@@ -343,6 +343,30 @@ jobs:
           path: ~/repo/packages/amplify-migration-tests/amplify-migration-reports
     working_directory: ~/repo
 
+  amplify_migration_tests_overrides:
+    <<: *defaults
+    environment:
+      AMPLIFY_PATH: /home/circleci/.npm-global/lib/node_modules/@aws-amplify/cli/bin/amplify
+    steps:
+      - attach_workspace:
+          at: ./
+      - restore_cache:
+          key: amplify-cli-yarn-deps-{{ .Branch }}-{{ checksum "yarn.lock" }}
+      - run:
+          name: Run tests migrating from CLI v6.0.1
+          command: |
+            source .circleci/local_publish_helpers.sh
+            changeNpmGlobalPath
+            cd packages/amplify-migration-tests
+            yarn run migration_v6.0.1 --maxWorkers=3 $TEST_SUITE
+          no_output_timeout: 90m
+      - run: *scan_e2e_test_artifacts
+      - store_test_results:
+          path: packages/amplify-migration-tests/
+      - store_artifacts:
+          path: ~/repo/packages/amplify-migration-tests/amplify-migration-reports
+    working_directory: ~/repo
+
   amplify_migration_tests_v4_30_0:
     <<: *defaults
     environment:
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 3df8618060e..00e13307285 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -358,6 +358,30 @@ jobs:
           path: packages/amplify-migration-tests/
       - store_artifacts:
           path: ~/repo/packages/amplify-migration-tests/amplify-migration-reports
+  amplify_migration_tests_overrides:
+    working_directory: ~/repo
+    docker: *ref_1
+    resource_class: large
+    environment:
+      AMPLIFY_PATH: /home/circleci/.npm-global/lib/node_modules/@aws-amplify/cli/bin/amplify
+    steps:
+      - attach_workspace:
+          at: ./
+      - restore_cache:
+          key: amplify-cli-yarn-deps-{{ .Branch }}-{{ checksum "yarn.lock" }}
+      - run:
+          name: Run tests migrating from CLI v6.0.1
+          command: |
+            source .circleci/local_publish_helpers.sh
+            changeNpmGlobalPath
+            cd packages/amplify-migration-tests
+            yarn run migration_v6.0.1 --maxWorkers=3 $TEST_SUITE
+          no_output_timeout: 90m
+      - run: *ref_4
+      - store_test_results:
+          path: packages/amplify-migration-tests/
+      - store_artifacts:
+          path: ~/repo/packages/amplify-migration-tests/amplify-migration-reports
   amplify_migration_tests_v4_30_0:
     working_directory: ~/repo
     docker: *ref_1
diff --git a/packages/amplify-cli-core/src/feature-flags/featureFlags.ts b/packages/amplify-cli-core/src/feature-flags/featureFlags.ts
index 39ea9488611..8e6655a7b40 100644
--- a/packages/amplify-cli-core/src/feature-flags/featureFlags.ts
+++ b/packages/amplify-cli-core/src/feature-flags/featureFlags.ts
@@ -706,13 +706,13 @@ export class FeatureFlags {
         name: 'auth',
         type: 'boolean',
         defaultValueForExistingProjects: false,
-        defaultValueForNewProjects: false,
+        defaultValueForNewProjects: true,
       },
       {
         name: 'project',
         type: 'boolean',
         defaultValueForExistingProjects: false,
-        defaultValueForNewProjects: false,
+        defaultValueForNewProjects: true,
       },
     ]);
   };
diff --git a/packages/amplify-cli-core/src/overrides-manager/override-skeleton-generator.ts b/packages/amplify-cli-core/src/overrides-manager/override-skeleton-generator.ts
index dce84ee061d..213c85f5e8f 100644
--- a/packages/amplify-cli-core/src/overrides-manager/override-skeleton-generator.ts
+++ b/packages/amplify-cli-core/src/overrides-manager/override-skeleton-generator.ts
@@ -2,7 +2,7 @@ import fs from 'fs-extra';
 import { $TSContext, getPackageManager } from '../index';
 import execa from 'execa';
 import * as path from 'path';
-import { printer } from 'amplify-prompts';
+import { printer, prompter } from 'amplify-prompts';
 import { JSONUtilities } from '../jsonUtilities';
 
 export const generateOverrideSkeleton = async (context: $TSContext, srcResourceDirPath: string, destDirPath: string): Promise<void> => {
@@ -25,10 +25,13 @@ export const generateOverrideSkeleton = async (context: $TSContext, srcResourceD
   await buildOverrideDir(backendDir, destDirPath);
 
   printer.success(`Successfully generated "override.ts" folder at ${destDirPath}`);
-  await context.amplify.openEditor(context, overrideFile);
+  const isOpen = await prompter.confirmContinue('Do you want to edit override.ts file now?');
+  if (isOpen) {
+    await context.amplify.openEditor(context, overrideFile);
+  }
 };
 
-export async function buildOverrideDir(cwd: string, destDirPath: string) {
+export async function buildOverrideDir(cwd: string, destDirPath: string): Promise<boolean> {
   const packageManager = getPackageManager(cwd);
 
   if (packageManager === null) {
@@ -41,6 +44,15 @@ export async function buildOverrideDir(cwd: string, destDirPath: string) {
       stdio: 'pipe',
       encoding: 'utf-8',
     });
+    // run tsc build to build override.ts file
+    const tsConfigDir = path.join(destDirPath, 'build');
+    const tsConfigFilePath = path.join(tsConfigDir, 'tsconfig.resource.json');
+    execa.sync('tsc', [`--project`, `${tsConfigFilePath}`], {
+      cwd: tsConfigDir,
+      stdio: 'pipe',
+      encoding: 'utf-8',
+    });
+    return true;
   } catch (error) {
     if ((error as any).code === 'ENOENT') {
       throw new Error(`Packaging overrides failed. Could not find ${packageManager} executable in the PATH.`);
@@ -48,15 +60,6 @@ export async function buildOverrideDir(cwd: string, destDirPath: string) {
       throw new Error(`Packaging overrides failed with the error \n${error.message}`);
     }
   }
-
-  // run tsc build to build override.ts file
-  const tsConfigDir = path.join(destDirPath, 'build');
-  const tsConfigFilePath = path.join(tsConfigDir, 'tsconfig.resource.json');
-  execa.sync('tsc', [`--project`, `${tsConfigFilePath}`], {
-    cwd: tsConfigDir,
-    stdio: 'pipe',
-    encoding: 'utf-8',
-  });
 }
 
 export const generateAmplifyOverrideProjectBuildFiles = (backendDir: string, srcResourceDirPath: string) => {
@@ -64,12 +67,14 @@ export const generateAmplifyOverrideProjectBuildFiles = (backendDir: string, src
   const tsConfigFilePath = path.join(backendDir, 'tsconfig.json');
   // add package.json to amplofy backend
   if (!fs.existsSync(packageJSONFilePath)) {
-    JSONUtilities.writeJson(packageJSONFilePath, JSONUtilities.readJson(path.join(srcResourceDirPath, 'package.json')));
+    const packageJson = JSONUtilities.readJson(path.join(srcResourceDirPath, 'package.json'));
+    JSONUtilities.writeJson(packageJSONFilePath, packageJson);
   }
 
   // add tsConfig.json to amplify backend
   if (!fs.existsSync(tsConfigFilePath)) {
-    JSONUtilities.writeJson(tsConfigFilePath, JSONUtilities.readJson(path.join(srcResourceDirPath, 'tsconfig.json')));
+    const tsConfigJson = JSONUtilities.readJson(path.join(srcResourceDirPath, 'tsconfig.json'));
+    JSONUtilities.writeJson(tsConfigFilePath, tsConfigJson);
   }
 };
 
diff --git a/packages/amplify-cli-core/src/state-manager/pathManager.ts b/packages/amplify-cli-core/src/state-manager/pathManager.ts
index 53c88f1b4ec..268aad89753 100644
--- a/packages/amplify-cli-core/src/state-manager/pathManager.ts
+++ b/packages/amplify-cli-core/src/state-manager/pathManager.ts
@@ -193,7 +193,7 @@ export class PathManager {
     ]);
   };
 
-  getRootStackDirPath = (projectPath: string): string => {
+  getRootStackBuildDirPath = (projectPath: string): string => {
     return this.constructPath(projectPath, [
       PathConstants.AmplifyDirName,
       PathConstants.BackendDirName,
diff --git a/packages/amplify-cli-overrides-helper/package.json b/packages/amplify-cli-overrides-helper/package.json
index ce1d0d9a90a..0add01b4871 100644
--- a/packages/amplify-cli-overrides-helper/package.json
+++ b/packages/amplify-cli-overrides-helper/package.json
@@ -27,7 +27,8 @@
     "clean": "rimraf ./lib"
   },
   "dependencies": {
-    "amplify-prompts": "1.1.2"
+    "amplify-prompts": "1.1.2",
+    "amplify-provider-awscloudformation": "4.60.1"
   },
   "devDependencies": {},
   "jest": {
diff --git a/packages/amplify-cli-overrides-helper/src/index.ts b/packages/amplify-cli-overrides-helper/src/index.ts
index 950b9bab82b..d8284ac82d6 100644
--- a/packages/amplify-cli-overrides-helper/src/index.ts
+++ b/packages/amplify-cli-overrides-helper/src/index.ts
@@ -2,12 +2,10 @@ import { printer } from 'amplify-prompts';
 
 function getProjectInfo(): void {
   printer.info('Hello from the skeleton of get project info');
-  return;
 }
 
 function addDependency(): void {
   printer.info('Hello from the skeleton of add dependency');
-  return;
 }
 
 export { getProjectInfo, addDependency };
diff --git a/packages/amplify-cli-overrides-helper/tsconfig.json b/packages/amplify-cli-overrides-helper/tsconfig.json
index 4db720dc27c..ec3ef0706fb 100644
--- a/packages/amplify-cli-overrides-helper/tsconfig.json
+++ b/packages/amplify-cli-overrides-helper/tsconfig.json
@@ -3,6 +3,10 @@
     "compilerOptions": {
       "outDir": "./lib",
       "rootDir": "./src",
-    }
-  }
+      "module": "ESNext"
+    },
+  "references": [
+    { "path": "../amplify-provider-awscloudformation" },
+    ]
+}
   
\ No newline at end of file
diff --git a/packages/amplify-cli/src/__tests__/commands/build-override.test.ts b/packages/amplify-cli/src/__tests__/commands/build-override.test.ts
index 92d8d7d0223..666ad6d2824 100644
--- a/packages/amplify-cli/src/__tests__/commands/build-override.test.ts
+++ b/packages/amplify-cli/src/__tests__/commands/build-override.test.ts
@@ -5,7 +5,7 @@ jest.mock('amplify-cli-core');
 jest.mock('amplify-provider-awscloudformation');
 
 describe('run build-override command', () => {
-  it('runs command successfully', async () => {
+  it('runs override command for only a resource', async () => {
     const context_stub = {
       amplify: {
         getResourceStatus: jest.fn().mockResolvedValue({
@@ -38,15 +38,100 @@ describe('run build-override command', () => {
         confirmPrompt: jest.fn().mockResolvedValue(true),
         invokePluginMethod: jest.fn(),
       },
+      input: {
+        subCommands: ['mockcategory1', 'mockResourceName1'],
+      },
+    };
+
+    const context_stub_typed = context_stub as unknown as $TSContext;
+    await run(context_stub_typed);
+    expect(context_stub_typed.amplify.invokePluginMethod).toBeCalledTimes(1);
+  });
+
+  it('runs override command for only all resources in a category', async () => {
+    const context_stub = {
+      amplify: {
+        getResourceStatus: jest.fn().mockResolvedValue({
+          resourcesToBeCreated: [
+            {
+              category: 'mockcategory1',
+              service: 'mockservice1',
+              resourceName: 'mockResourceName1',
+            },
+            {
+              category: 'mockcategory1',
+              service: 'mockservice2',
+              resourceName: 'mockResourceName2',
+            },
+          ],
+          resourcesToBeUpdated: [
+            {
+              category: 'mockcategory1',
+              service: 'mockservice3',
+              resourceName: 'mockResourceName3',
+            },
+            {
+              category: 'mockcategory4',
+              service: 'mockservice4',
+              resourceName: 'mockResourceName4',
+            },
+          ],
+        }),
+
+        confirmPrompt: jest.fn().mockResolvedValue(true),
+        invokePluginMethod: jest.fn(),
+      },
+      input: {
+        subCommands: ['mockcategory1'],
+      },
     };
 
     const context_stub_typed = context_stub as unknown as $TSContext;
     await run(context_stub_typed);
-    expect(context_stub_typed.amplify.invokePluginMethod).toBeCalledTimes(4);
+    expect(context_stub_typed.amplify.invokePluginMethod).toBeCalledTimes(3);
+  });
+
+  it('runs override command successfully for all resources in all categories', async () => {
+    const context_stub = {
+      amplify: {
+        getResourceStatus: jest.fn().mockResolvedValue({
+          resourcesToBeCreated: [
+            {
+              category: 'mockcategory1',
+              service: 'mockservice1',
+              resourceName: 'mockResourceName1',
+            },
+            {
+              category: 'mockcategory2',
+              service: 'mockservice2',
+              resourceName: 'mockResourceName2',
+            },
+          ],
+          resourcesToBeUpdated: [
+            {
+              category: 'mockcategory3',
+              service: 'mockservice3',
+              resourceName: 'mockResourceName3',
+            },
+            {
+              category: 'mockcategory4',
+              service: 'mockservice4',
+              resourceName: 'mockResourceName4',
+            },
+          ],
+        }),
+
+        confirmPrompt: jest.fn().mockResolvedValue(true),
+        invokePluginMethod: jest.fn(),
+      },
+    };
+
+    const context_stub_typed = context_stub as unknown as $TSContext;
+    await run(context_stub_typed);
+    expect(context_stub_typed.amplify.invokePluginMethod).toBeCalledTimes(5);
   });
 
   it('runs command successfully empty Arrays', async () => {
-    jest.clearAllMocks();
     const context_stub = {
       amplify: {
         getResourceStatus: jest.fn().mockResolvedValue({
@@ -55,11 +140,12 @@ describe('run build-override command', () => {
         }),
 
         confirmPrompt: jest.fn().mockResolvedValue(true),
+        invokePluginMethod: jest.fn(),
       },
     };
 
     const context_stub_typed = context_stub as unknown as $TSContext;
     await run(context_stub_typed);
-    expect(context_stub_typed.amplify.invokePluginMethod).toBeUndefined();
+    expect(context_stub_typed.amplify.invokePluginMethod).toBeCalledTimes(1);
   });
 });
diff --git a/packages/amplify-cli/src/__tests__/extensions/amplify-helpers/resource-status-diff.test.ts b/packages/amplify-cli/src/__tests__/extensions/amplify-helpers/resource-status-diff.test.ts
index e20ec013117..93401a20062 100644
--- a/packages/amplify-cli/src/__tests__/extensions/amplify-helpers/resource-status-diff.test.ts
+++ b/packages/amplify-cli/src/__tests__/extensions/amplify-helpers/resource-status-diff.test.ts
@@ -1,12 +1,10 @@
-import { capitalize, 
-         globCFNFilePath, 
-         ResourceDiff, 
-         stackMutationType} from '../../../extensions/amplify-helpers/resource-status-diff';
+import { capitalize, globCFNFilePath, ResourceDiff, stackMutationType } from '../../../extensions/amplify-helpers/resource-status-diff';
 import { CLOUD_INITIALIZED } from '../../../extensions/amplify-helpers/get-cloud-init-status';
 import glob from 'glob';
 import path from 'path';
 import * as fs from 'fs-extra';
-import { stateManager, pathManager} from 'amplify-cli-core';
+import { stateManager, pathManager } from 'amplify-cli-core';
+import { cronJobSetting } from '../../../../../amplify-category-function/lib/provider-utils/awscloudformation/utils/constants';
 
 //Mock Glob to fetch test cloudformation
 jest.mock('glob');
@@ -14,155 +12,180 @@ const localBackendDirPathStub = 'localBackendDirPath';
 const currentBackendDirPathStub = 'currentCloudBackendPath';
 const testApiName = 'testApiName';
 const globMock = glob as jest.Mocked<typeof glob>;
-const allFiles: string[] =  [ "cloudformation-template.json",	"parameters.json" , "resolvers", 
-                              "stacks" ,"functions", "pipelinesFunctions", "schema.graphql" ]
-const templateMatchRegex =  ".*template\.(json|yaml|yml)$"
-globMock.sync.mockImplementation(() => allFiles.filter( fname => fname.match(templateMatchRegex) ));
-
+const allFiles: string[] = [
+  'cloudformation-template.json',
+  'parameters.json',
+  'resolvers',
+  'stacks',
+  'functions',
+  'pipelinesFunctions',
+  'schema.graphql',
+];
+const templateMatchRegex = '.*template.(json|yaml|yml)$';
+globMock.sync.mockImplementation(() => allFiles.filter(fname => fname.match(templateMatchRegex)));
 
 //Mock fs to pass all file-system checks
 jest.mock('fs-extra', () => ({
-    ...(jest.requireActual('fs-extra') as {}),
-    existsSync: jest.fn().mockImplementation(()=> true),
-    statSync: jest.fn().mockReturnValue({ isFile: ()=>true } as fs.Stats )
+  ...(jest.requireActual('fs-extra') as {}),
+  existsSync: jest.fn().mockImplementation(() => true),
+  statSync: jest.fn().mockReturnValue({ isFile: () => true } as fs.Stats),
 }));
 
-
+jest.mock('amplify-cli-core', () => ({
+  ...(jest.requireActual('amplify-cli-core') as {}),
+  FeatureFlags: {
+    getBoolean: jest.fn(),
+    getNumber: jest.fn(),
+  },
+}));
 
 describe('resource-status-diff helpers', () => {
-
-    beforeAll(() => {
-        jest.unmock('amplify-cli-core');
-      })
-
-    it('capitalize should capitalize strings', async () => {
-        const mockInput = "abcd";
-        const expectedOutput = "Abcd";
-        expect(capitalize(mockInput)).toBe( expectedOutput );
-    });
-    
-    it('should Glob only cloudformation template files ', async () => {
-       
-        const mockCloudformationTemplateName = "cloudformation-template.json"
-        const stubFileFolder = "stub-file-folder"
-        const expectedGlobOptions  = {
-            absolute: false,
-            cwd: stubFileFolder,
-            follow: false,
-            nodir: true,
-        };
-
-        const cfnFilename = globCFNFilePath( stubFileFolder );
-        expect(globMock.sync.mock.calls.length).toBe(1);
-        expect(globMock.sync).toBeCalledWith('**/*template.{yaml,yml,json}', expectedGlobOptions);
-        expect( cfnFilename ).toBe(`${stubFileFolder}/${mockCloudformationTemplateName}`);
-    });
-
-    it('should search both Build and non Build folders for Cloudformation Templates ', async () => {
-        const mockGraphQLAPIMeta = { 
-                                        providers: {
-                                            awscloudformation: {
-                                            Region: 'myMockRegion',
-                                            },
-                                        },
-                                        'api': { 
-                                                [testApiName] : { 
-                                                        service : 'AppSync'
-                                                }
-                                            }
-                                   };
-
-        //Enable cloud initialized to test updates , but retain all other functions
-        jest.mock('../../../extensions/amplify-helpers/get-cloud-init-status', () => ({
-            ...(jest.requireActual('../../../extensions/amplify-helpers/get-cloud-init-status') as {}),
-            getCloudInitStatus: jest.fn().mockImplementation(()=> CLOUD_INITIALIZED),
-        }));
-
-        //helper to mock common dependencies 
-        const setMockTestCommonDependencies = ()=>{
-            jest.mock('amplify-cli-core');
-            const pathManagerMock =  pathManager as jest.Mocked<typeof pathManager>;
-            pathManagerMock.getBackendDirPath = jest.fn().mockImplementation(() => localBackendDirPathStub);
-            pathManagerMock.getCurrentCloudBackendDirPath = jest.fn().mockImplementation(() => currentBackendDirPathStub);
-    
-            const stateManagerMock = stateManager as jest.Mocked<typeof stateManager>;
-            stateManagerMock.getMeta = jest.fn().mockImplementation(()=> mockGraphQLAPIMeta);
-            stateManagerMock.getCurrentMeta = jest.fn().mockImplementation(()=> mockGraphQLAPIMeta); 
-                    
-        }
-
-        const getMockInputData = ()=>{
-
-            return {
-                mockDefaultRootCfnTmpltName : "cloudformation-template.json",
-                mockCategory : "api",
-                mockResourceName : testApiName,
-                mockProvider : "awscloudformation", 
-                normalizedProvider : "cloudformation",
-                mockMutationInfo: stackMutationType.UPDATE
-            }
-        }
-        
-        //Test mocks
-        setMockTestCommonDependencies();
-        const input = getMockInputData();
-
-        /** 1. Code-Under-Test - constructor **/
-        const resourceDiff = new ResourceDiff(input.mockCategory, input.mockResourceName, input.mockProvider , input.mockMutationInfo);
-        
-        //Test Definitions
-        const checkProviderNormalization = ()=> {
-            expect(resourceDiff.provider ).toBe(input.normalizedProvider);
-        }
-
-        const checkCfnPaths = ()=> {
-            const mockLocalPreBuildCfnFile = path.join(localBackendDirPathStub, input.mockCategory, input.mockResourceName, input.mockDefaultRootCfnTmpltName);
-            const mockCurrentPreBuildCfnFile = path.join(currentBackendDirPathStub, input.mockCategory, input.mockResourceName, input.mockDefaultRootCfnTmpltName);
-            const mockLocalPostBuildCfnFile = path.join(localBackendDirPathStub,input.mockCategory, input.mockResourceName,'build', input.mockDefaultRootCfnTmpltName);
-            const mockCurrentPostBuildCfnFile = path.join(currentBackendDirPathStub,input.mockCategory, input.mockResourceName,'build', input.mockDefaultRootCfnTmpltName);
-            expect(resourceDiff.resourceFiles.localPreBuildCfnFile).toBe(mockLocalPreBuildCfnFile);
-            expect(resourceDiff.resourceFiles.cloudPreBuildCfnFile).toBe(mockCurrentPreBuildCfnFile);
-            expect(resourceDiff.resourceFiles.localBuildCfnFile).toBe(mockLocalPostBuildCfnFile);
-            expect(resourceDiff.resourceFiles.cloudBuildCfnFile).toBe(mockCurrentPostBuildCfnFile);
-        }
-
-        //Test Execution
-        checkProviderNormalization();
-        checkCfnPaths();
-      
-        
-    })
-
-    it ( 'should show the diff between local and remote cloudformation ', async ()=>{
-
-        const getMockInputData = ()=>{
-
-            return {
-                mockDefaultRootCfnTmpltName : "cloudformation-template.json",
-                mockCategory : "api",
-                mockResourceName : testApiName,
-                mockProvider : "awscloudformation", 
-                normalizedProvider : "cloudformation",
-                mockMutationInfo: stackMutationType.UPDATE
-            }
-        }
-
-        const input = getMockInputData();
-
-        /** 1. Code-Under-Test - constructor **/
-        const resourceDiff = new ResourceDiff(input.mockCategory, input.mockResourceName, input.mockProvider , input.mockMutationInfo);
-
-        /** 2. Code-Under-Test calculateCfnDiff **/
-        //update sample cloudformation paths in resourceDiff
-        const localPath = `${__dirname}/testData/mockLocalCloud/cloudformation-template.json`;
-        const cloudPath = `${__dirname}/testData/mockCurrentCloud/cloudformation-template.json`;
-        //override paths to point to reference cloudformation templates
-        resourceDiff.resourceFiles.localBuildCfnFile = localPath;
-        resourceDiff.resourceFiles.cloudBuildCfnFile = cloudPath;
-        resourceDiff.resourceFiles.localPreBuildCfnFile = localPath;
-        resourceDiff.resourceFiles.cloudPreBuildCfnFile = cloudPath;
-        const diff = await resourceDiff.calculateCfnDiff();
-        expect( diff ).toMatchSnapshot();
-    })
-
-});
\ No newline at end of file
+  beforeAll(() => {
+    jest.unmock('amplify-cli-core');
+  });
+
+  it('capitalize should capitalize strings', async () => {
+    const mockInput = 'abcd';
+    const expectedOutput = 'Abcd';
+    expect(capitalize(mockInput)).toBe(expectedOutput);
+  });
+
+  it('should Glob only cloudformation template files ', async () => {
+    const mockCloudformationTemplateName = 'cloudformation-template.json';
+    const stubFileFolder = 'stub-file-folder';
+    const expectedGlobOptions = {
+      absolute: false,
+      cwd: stubFileFolder,
+      follow: false,
+      nodir: true,
+    };
+
+    const cfnFilename = globCFNFilePath(stubFileFolder);
+    expect(globMock.sync.mock.calls.length).toBe(1);
+    expect(globMock.sync).toBeCalledWith('**/*template.{yaml,yml,json}', expectedGlobOptions);
+    expect(cfnFilename).toBe(`${stubFileFolder}/${mockCloudformationTemplateName}`);
+  });
+
+  it('should search both Build and non Build folders for Cloudformation Templates ', async () => {
+    const mockGraphQLAPIMeta = {
+      providers: {
+        awscloudformation: {
+          Region: 'myMockRegion',
+        },
+      },
+      api: {
+        [testApiName]: {
+          service: 'AppSync',
+        },
+      },
+    };
+
+    //Enable cloud initialized to test updates , but retain all other functions
+    jest.mock('../../../extensions/amplify-helpers/get-cloud-init-status', () => ({
+      ...(jest.requireActual('../../../extensions/amplify-helpers/get-cloud-init-status') as {}),
+      getCloudInitStatus: jest.fn().mockImplementation(() => CLOUD_INITIALIZED),
+    }));
+
+    //helper to mock common dependencies
+    const setMockTestCommonDependencies = () => {
+      jest.mock('amplify-cli-core');
+      const pathManagerMock = pathManager as jest.Mocked<typeof pathManager>;
+      pathManagerMock.getBackendDirPath = jest.fn().mockImplementation(() => localBackendDirPathStub);
+      pathManagerMock.getCurrentCloudBackendDirPath = jest.fn().mockImplementation(() => currentBackendDirPathStub);
+
+      const stateManagerMock = stateManager as jest.Mocked<typeof stateManager>;
+      stateManagerMock.getMeta = jest.fn().mockImplementation(() => mockGraphQLAPIMeta);
+      stateManagerMock.getCurrentMeta = jest.fn().mockImplementation(() => mockGraphQLAPIMeta);
+    };
+
+    const getMockInputData = () => {
+      return {
+        mockDefaultRootCfnTmpltName: 'cloudformation-template.json',
+        mockCategory: 'api',
+        mockResourceName: testApiName,
+        mockProvider: 'awscloudformation',
+        normalizedProvider: 'cloudformation',
+        mockMutationInfo: stackMutationType.UPDATE,
+      };
+    };
+
+    //Test mocks
+    setMockTestCommonDependencies();
+    const input = getMockInputData();
+
+    /** 1. Code-Under-Test - constructor **/
+    const resourceDiff = new ResourceDiff(input.mockCategory, input.mockResourceName, input.mockProvider, input.mockMutationInfo);
+
+    //Test Definitions
+    const checkProviderNormalization = () => {
+      expect(resourceDiff.provider).toBe(input.normalizedProvider);
+    };
+
+    const checkCfnPaths = () => {
+      const mockLocalPreBuildCfnFile = path.join(
+        localBackendDirPathStub,
+        input.mockCategory,
+        input.mockResourceName,
+        input.mockDefaultRootCfnTmpltName,
+      );
+      const mockCurrentPreBuildCfnFile = path.join(
+        currentBackendDirPathStub,
+        input.mockCategory,
+        input.mockResourceName,
+        input.mockDefaultRootCfnTmpltName,
+      );
+      const mockLocalPostBuildCfnFile = path.join(
+        localBackendDirPathStub,
+        input.mockCategory,
+        input.mockResourceName,
+        'build',
+        input.mockDefaultRootCfnTmpltName,
+      );
+      const mockCurrentPostBuildCfnFile = path.join(
+        currentBackendDirPathStub,
+        input.mockCategory,
+        input.mockResourceName,
+        'build',
+        input.mockDefaultRootCfnTmpltName,
+      );
+      expect(resourceDiff.resourceFiles.localPreBuildCfnFile).toBe(mockLocalPreBuildCfnFile);
+      expect(resourceDiff.resourceFiles.cloudPreBuildCfnFile).toBe(mockCurrentPreBuildCfnFile);
+      expect(resourceDiff.resourceFiles.localBuildCfnFile).toBe(mockLocalPostBuildCfnFile);
+      expect(resourceDiff.resourceFiles.cloudBuildCfnFile).toBe(mockCurrentPostBuildCfnFile);
+    };
+
+    //Test Execution
+    checkProviderNormalization();
+    checkCfnPaths();
+  });
+
+  it('should show the diff between local and remote cloudformation ', async () => {
+    const getMockInputData = () => {
+      return {
+        mockDefaultRootCfnTmpltName: 'cloudformation-template.json',
+        mockCategory: 'api',
+        mockResourceName: testApiName,
+        mockProvider: 'awscloudformation',
+        normalizedProvider: 'cloudformation',
+        mockMutationInfo: stackMutationType.UPDATE,
+      };
+    };
+
+    const input = getMockInputData();
+
+    /** 1. Code-Under-Test - constructor **/
+    const resourceDiff = new ResourceDiff(input.mockCategory, input.mockResourceName, input.mockProvider, input.mockMutationInfo);
+
+    /** 2. Code-Under-Test calculateCfnDiff **/
+    //update sample cloudformation paths in resourceDiff
+    const localPath = `${__dirname}/testData/mockLocalCloud/cloudformation-template.json`;
+    const cloudPath = `${__dirname}/testData/mockCurrentCloud/cloudformation-template.json`;
+    //override paths to point to reference cloudformation templates
+    resourceDiff.resourceFiles.localBuildCfnFile = localPath;
+    resourceDiff.resourceFiles.cloudBuildCfnFile = cloudPath;
+    resourceDiff.resourceFiles.localPreBuildCfnFile = localPath;
+    resourceDiff.resourceFiles.cloudPreBuildCfnFile = cloudPath;
+    const diff = await resourceDiff.calculateCfnDiff();
+    expect(diff).toMatchSnapshot();
+  });
+});
diff --git a/packages/amplify-cli/src/__tests__/extensions/amplify-helpers/resource-status.test.ts b/packages/amplify-cli/src/__tests__/extensions/amplify-helpers/resource-status.test.ts
index b313026943e..690a56e6b5d 100644
--- a/packages/amplify-cli/src/__tests__/extensions/amplify-helpers/resource-status.test.ts
+++ b/packages/amplify-cli/src/__tests__/extensions/amplify-helpers/resource-status.test.ts
@@ -12,6 +12,7 @@ import {
 } from '../../../extensions/amplify-helpers/get-cloud-init-status';
 import { stateManager } from 'amplify-cli-core';
 import { hashLayerResource } from 'amplify-category-function';
+import { cronJobSetting } from '../../../../../amplify-category-function/lib/provider-utils/awscloudformation/utils/constants';
 
 const sample_hash1 = 'testhash1';
 const sample_hash2 = 'testhash2';
@@ -51,6 +52,10 @@ jest.mock('../../../extensions/amplify-helpers/get-cloud-init-status', () => ({
   getCloudInitStatus: jest.fn(),
 }));
 
+jest.mock('../../../extensions/amplify-helpers/root-stack-status', () => ({
+  isRootStackModifiedSinceLastPush: jest.fn().mockResolvedValue(false),
+}));
+
 const backendDirPathStub = 'backendDirPath';
 const currentBackendDirPathStub = 'currentBackendDirPathStub';
 const projectRootPath = 'projectRootPath';
@@ -70,6 +75,9 @@ jest.mock('amplify-cli-core', () => ({
     getCurrentCloudBackendDirPath: jest.fn(() => currentBackendDirPathStub),
     findProjectRoot: jest.fn(() => projectRootPath),
   },
+  FeatureFlags: {
+    getBoolean: jest.fn().mockReturnValue(true),
+  },
 }));
 
 jest.mock('amplify-category-function', () => ({
@@ -145,6 +153,7 @@ describe('resource-status', () => {
         resourcesToBeDeleted: [],
         resourcesToBeSynced: [],
         resourcesToBeUpdated: [],
+        rootStackUpdated: false,
         tagsUpdated: false,
       });
     });
@@ -184,6 +193,7 @@ describe('resource-status', () => {
         resourcesToBeSynced: [],
         resourcesToBeUpdated: [],
         tagsUpdated: false,
+        rootStackUpdated: false,
       });
     });
 
@@ -246,6 +256,7 @@ describe('resource-status', () => {
         resourcesToBeSynced: [],
         resourcesToBeUpdated: [],
         tagsUpdated: false,
+        rootStackUpdated: false,
       });
     });
 
@@ -284,6 +295,7 @@ describe('resource-status', () => {
         resourcesToBeSynced: [],
         resourcesToBeUpdated: [],
         tagsUpdated: false,
+        rootStackUpdated: false,
       });
     });
 
@@ -336,6 +348,7 @@ describe('resource-status', () => {
         ],
         resourcesToBeUpdated: [],
         tagsUpdated: false,
+        rootStackUpdated: false,
       });
     });
 
@@ -380,6 +393,7 @@ describe('resource-status', () => {
         ],
         resourcesToBeUpdated: [],
         tagsUpdated: false,
+        rootStackUpdated: false,
       });
     });
 
@@ -439,6 +453,7 @@ describe('resource-status', () => {
         ],
         resourcesToBeUpdated: [],
         tagsUpdated: false,
+        rootStackUpdated: false,
       });
     });
 
@@ -502,6 +517,7 @@ describe('resource-status', () => {
           },
         ],
         tagsUpdated: false,
+        rootStackUpdated: false,
       });
     });
 
@@ -559,6 +575,7 @@ describe('resource-status', () => {
           },
         ],
         tagsUpdated: false,
+        rootStackUpdated: false,
       });
     });
 
@@ -614,6 +631,7 @@ describe('resource-status', () => {
           },
         ],
         tagsUpdated: false,
+        rootStackUpdated: false,
       });
     });
 
@@ -669,6 +687,7 @@ describe('resource-status', () => {
           },
         ],
         tagsUpdated: false,
+        rootStackUpdated: false,
       });
     });
 
@@ -699,6 +718,7 @@ describe('resource-status', () => {
         resourcesToBeSynced: [],
         resourcesToBeUpdated: [],
         tagsUpdated: true,
+        rootStackUpdated: false,
       });
     });
 
@@ -713,6 +733,7 @@ describe('resource-status', () => {
         resourcesToBeSynced: [],
         resourcesToBeUpdated: [],
         tagsUpdated: false,
+        rootStackUpdated: false,
       });
     });
 
diff --git a/packages/amplify-cli/src/commands/build-override.ts b/packages/amplify-cli/src/commands/build-override.ts
index 05b0dc4fa7a..4f85a91b4bf 100644
--- a/packages/amplify-cli/src/commands/build-override.ts
+++ b/packages/amplify-cli/src/commands/build-override.ts
@@ -1,13 +1,14 @@
 import { $TSContext, IAmplifyResource } from 'amplify-cli-core';
 import { printer } from 'amplify-prompts';
+import { Console } from 'console';
 /**
  * Command to transform CFN with overrides
  */
 const subcommand = 'build-override';
 
 export const run = async (context: $TSContext) => {
-  let resourceName = context?.input?.subCommands?.[0];
-  const categoryName = context?.input?.subCommands?.[1];
+  const categoryName = context?.input?.subCommands?.[0];
+  let resourceName = context?.input?.subCommands?.[1];
 
   if (categoryName === undefined) {
     // if no category is mentioned , then defaults to all resource
@@ -16,14 +17,19 @@ export const run = async (context: $TSContext) => {
 
   try {
     const resourcesToBuild: IAmplifyResource[] = await getResources(context);
-    let filteredResources = {};
+    let filteredResources: IAmplifyResource[] = resourcesToBuild;
     if (categoryName) {
-      filteredResources = resourcesToBuild.filter(resource => resource.category === categoryName);
+      filteredResources = filteredResources.filter(resource => resource.category === categoryName);
     }
     if (categoryName && resourceName) {
-      filteredResources = resourcesToBuild.filter(resource => resource.category === categoryName && resource.resourceName === resourceName);
+      filteredResources = filteredResources.filter(
+        resource => resource.category === categoryName && resource.resourceName === resourceName,
+      );
     }
-    for (const resource of resourcesToBuild) {
+    if (!categoryName && !resourceName) {
+      await context.amplify.invokePluginMethod(context, 'awscloudformation', undefined, 'transformResourceWithOverrides', [context]);
+    }
+    for (const resource of filteredResources) {
       await context.amplify.invokePluginMethod(context, 'awscloudformation', undefined, 'transformResourceWithOverrides', [
         context,
         resource,
diff --git a/packages/amplify-cli/src/extensions/amplify-helpers/resource-status-data.ts b/packages/amplify-cli/src/extensions/amplify-helpers/resource-status-data.ts
index e0645441fe8..68daf66d6c7 100644
--- a/packages/amplify-cli/src/extensions/amplify-helpers/resource-status-data.ts
+++ b/packages/amplify-cli/src/extensions/amplify-helpers/resource-status-data.ts
@@ -3,25 +3,26 @@ import * as fs from 'fs-extra';
 import * as path from 'path';
 import { ServiceName as FunctionServiceName, hashLayerResource } from 'amplify-category-function';
 import { removeGetUserEndpoints } from '../amplify-helpers/remove-pinpoint-policy';
-import { pathManager, stateManager, NotInitializedError, ViewResourceTableParams } from 'amplify-cli-core';
+import { pathManager, stateManager, NotInitializedError, ViewResourceTableParams, FeatureFlags } from 'amplify-cli-core';
 import { hashElement, HashElementOptions } from 'folder-hash';
 import { CLOUD_INITIALIZED, CLOUD_NOT_INITIALIZED, getCloudInitStatus } from './get-cloud-init-status';
 import * as resourceStatus from './resource-status-diff';
 import { IResourceDiffCollection, capitalize } from './resource-status-diff';
+import { getHashForRootStack, isRootStackModifiedSinceLastPush } from './root-stack-status';
 
 //API: Filter resource status for the given categories
 export async function getMultiCategoryStatus(inputs: ViewResourceTableParams | undefined) {
-    let resourceStatusResults = await getResourceStatus();
-    if (inputs?.categoryList?.length) {
-      //diffs for only the required categories (amplify -v <category1>...<categoryN>)
-      //TBD: optimize search
-      resourceStatusResults.resourcesToBeCreated = filterResourceCategory(resourceStatusResults.resourcesToBeCreated, inputs.categoryList);
-      resourceStatusResults.resourcesToBeUpdated = filterResourceCategory(resourceStatusResults.resourcesToBeUpdated, inputs.categoryList);
-      resourceStatusResults.resourcesToBeSynced = filterResourceCategory(resourceStatusResults.resourcesToBeSynced, inputs.categoryList);
-      resourceStatusResults.resourcesToBeDeleted = filterResourceCategory(resourceStatusResults.resourcesToBeDeleted, inputs.categoryList);
-      resourceStatusResults.allResources = filterResourceCategory(resourceStatusResults.allResources, inputs.categoryList);
-    }
-    return resourceStatusResults;
+  let resourceStatusResults = await getResourceStatus();
+  if (inputs?.categoryList?.length) {
+    //diffs for only the required categories (amplify -v <category1>...<categoryN>)
+    //TBD: optimize search
+    resourceStatusResults.resourcesToBeCreated = filterResourceCategory(resourceStatusResults.resourcesToBeCreated, inputs.categoryList);
+    resourceStatusResults.resourcesToBeUpdated = filterResourceCategory(resourceStatusResults.resourcesToBeUpdated, inputs.categoryList);
+    resourceStatusResults.resourcesToBeSynced = filterResourceCategory(resourceStatusResults.resourcesToBeSynced, inputs.categoryList);
+    resourceStatusResults.resourcesToBeDeleted = filterResourceCategory(resourceStatusResults.resourcesToBeDeleted, inputs.categoryList);
+    resourceStatusResults.allResources = filterResourceCategory(resourceStatusResults.allResources, inputs.categoryList);
+  }
+  return resourceStatusResults;
 }
 
 export async function getResourceDiffs(resourcesToBeUpdated, resourcesToBeDeleted, resourcesToBeCreated) {
@@ -33,32 +34,27 @@ export async function getResourceDiffs(resourcesToBeUpdated, resourcesToBeDelete
   return result;
 }
 
-function resourceToTableRow( resource, operation ){
-  return [
-    capitalize(resource.category),
-    resource.resourceName,
-    operation /*syncOperationLabel*/,
-    resource.providerPlugin,
-  ]
+function resourceToTableRow(resource, operation) {
+  return [capitalize(resource.category), resource.resourceName, operation /*syncOperationLabel*/, resource.providerPlugin];
 }
 
 const ResourceOperationLabel = {
-  Create : 'Create',
-  Update : 'Update',
-  Delete : 'Delete',
-  Import : 'Import',
-  Unlink : 'Unlink',
-  NoOp : 'No Change',
-}
+  Create: 'Create',
+  Update: 'Update',
+  Delete: 'Delete',
+  Import: 'Import',
+  Unlink: 'Unlink',
+  NoOp: 'No Change',
+};
 
 const TableColumnLabels = {
   Category: 'Category',
   ResourceName: 'Resource name',
   Operation: 'Operation',
-  ProviderPlugin: 'Provider plugin'
-}
+  ProviderPlugin: 'Provider plugin',
+};
 
-function getLabelForResourceSyncOperation( syncOperationType : string ) {
+function getLabelForResourceSyncOperation(syncOperationType: string) {
   switch (syncOperationType) {
     case 'import':
       return ResourceOperationLabel.Import;
@@ -84,30 +80,29 @@ export function getSummaryTableData({
   );
   noChangeResources = noChangeResources.filter(resource => resource.category !== 'providers');
 
-  const tableOptions = [[TableColumnLabels.Category,
-                         TableColumnLabels.ResourceName,
-                         TableColumnLabels.Operation,
-                         TableColumnLabels.ProviderPlugin]];
+  const tableOptions = [
+    [TableColumnLabels.Category, TableColumnLabels.ResourceName, TableColumnLabels.Operation, TableColumnLabels.ProviderPlugin],
+  ];
 
-  for ( const resource of resourcesToBeCreated ) {
-    tableOptions.push( resourceToTableRow(resource, ResourceOperationLabel.Create) );
+  for (const resource of resourcesToBeCreated) {
+    tableOptions.push(resourceToTableRow(resource, ResourceOperationLabel.Create));
   }
 
   for (const resource of resourcesToBeUpdated) {
-    tableOptions.push( resourceToTableRow(resource, ResourceOperationLabel.Update) )
+    tableOptions.push(resourceToTableRow(resource, ResourceOperationLabel.Update));
   }
 
   for (const resource of resourcesToBeSynced) {
     const operation = getLabelForResourceSyncOperation(resource.sync);
-    tableOptions.push( resourceToTableRow( resource, operation  /*syncOperationLabel*/ ) )
+    tableOptions.push(resourceToTableRow(resource, operation /*syncOperationLabel*/));
   }
 
   for (const resource of resourcesToBeDeleted) {
     tableOptions.push(resourceToTableRow(resource, ResourceOperationLabel.Delete));
   }
 
-  for (const resource of noChangeResources ) {
-    tableOptions.push(resourceToTableRow( resource, ResourceOperationLabel.NoOp));
+  for (const resource of noChangeResources) {
+    tableOptions.push(resourceToTableRow(resource, ResourceOperationLabel.NoOp));
   }
   return tableOptions;
 }
@@ -137,14 +132,29 @@ export async function getResourceStatus(
   // if not equal there is a tag update
   const tagsUpdated = !_.isEqual(stateManager.getProjectTags(), stateManager.getCurrentProjectTags());
 
-  return {
-    resourcesToBeCreated,
-    resourcesToBeUpdated,
-    resourcesToBeSynced,
-    resourcesToBeDeleted,
-    tagsUpdated,
-    allResources,
-  };
+  // if not equal there is a root stack update
+  if (FeatureFlags.getBoolean('overrides.project')) {
+    const rootStackUpdated = await isRootStackModifiedSinceLastPush(getHashForRootStack);
+
+    return {
+      resourcesToBeCreated,
+      resourcesToBeUpdated,
+      resourcesToBeSynced,
+      resourcesToBeDeleted,
+      rootStackUpdated,
+      tagsUpdated,
+      allResources,
+    };
+  } else {
+    return {
+      resourcesToBeCreated,
+      resourcesToBeUpdated,
+      resourcesToBeSynced,
+      resourcesToBeDeleted,
+      tagsUpdated,
+      allResources,
+    };
+  }
 }
 
 export function getAllResources(amplifyMeta, category, resourceName, filteredResources) {
@@ -523,4 +533,3 @@ async function asyncForEach(array, callback) {
     await callback(array[index], index, array);
   }
 }
-
diff --git a/packages/amplify-cli/src/extensions/amplify-helpers/resource-status-diff.ts b/packages/amplify-cli/src/extensions/amplify-helpers/resource-status-diff.ts
index 72abd96d143..4f28751c6a2 100644
--- a/packages/amplify-cli/src/extensions/amplify-helpers/resource-status-diff.ts
+++ b/packages/amplify-cli/src/extensions/amplify-helpers/resource-status-diff.ts
@@ -1,4 +1,3 @@
-
 import * as fs from 'fs-extra';
 import * as path from 'path';
 import * as glob from 'glob';
@@ -10,78 +9,78 @@ import { Template } from 'cloudform-types';
 import { getResourceService } from './resource-status-data';
 
 const CategoryProviders = {
-    CLOUDFORMATION : "cloudformation",
-}
+  CLOUDFORMATION: 'cloudformation',
+};
 
 export interface StackMutationInfo {
-  label : String;
-  consoleStyle : chalk.Chalk;
-  icon : String;
+  label: String;
+  consoleStyle: chalk.Chalk;
+  icon: String;
 }
 //helper for summary styling
 export interface StackMutationType {
-  CREATE : StackMutationInfo,
-  UPDATE : StackMutationInfo,
-  DELETE : StackMutationInfo,
-  IMPORT : StackMutationInfo,
-  UNLINK : StackMutationInfo,
-  NOCHANGE : StackMutationInfo,
+  CREATE: StackMutationInfo;
+  UPDATE: StackMutationInfo;
+  DELETE: StackMutationInfo;
+  IMPORT: StackMutationInfo;
+  UNLINK: StackMutationInfo;
+  NOCHANGE: StackMutationInfo;
 }
 //helper map from mutation-type to ux styling
-export const stackMutationType :  StackMutationType = {
-    CREATE : {
-      label : "Create",
-      consoleStyle : chalk.green.bold,
-      icon : "[+]"
-    },
-    UPDATE : {
-      label : "Update",
-      consoleStyle : chalk.yellow.bold,
-      icon : "[~]"
-    },
+export const stackMutationType: StackMutationType = {
+  CREATE: {
+    label: 'Create',
+    consoleStyle: chalk.green.bold,
+    icon: '[+]',
+  },
+  UPDATE: {
+    label: 'Update',
+    consoleStyle: chalk.yellow.bold,
+    icon: '[~]',
+  },
 
-    DELETE : {
-      label: "Delete",
-      consoleStyle : chalk.red.bold,
-      icon : "[-]"
-    },
+  DELETE: {
+    label: 'Delete',
+    consoleStyle: chalk.red.bold,
+    icon: '[-]',
+  },
 
-    IMPORT : {
-      label: "Import",
-      consoleStyle : chalk.blue.bold,
-      icon : `[\u21E9]`
-    },
+  IMPORT: {
+    label: 'Import',
+    consoleStyle: chalk.blue.bold,
+    icon: `[\u21E9]`,
+  },
 
-    UNLINK : {
-      label : "Unlink",
-      consoleStyle : chalk.red.bold,
-      icon : `[\u2BFB]`
-    },
-    NOCHANGE : {
-      label : "No Change",
-      consoleStyle : chalk.grey,
-      icon : `[ ]`
-    }
-}
+  UNLINK: {
+    label: 'Unlink',
+    consoleStyle: chalk.red.bold,
+    icon: `[\u2BFB]`,
+  },
+  NOCHANGE: {
+    label: 'No Change',
+    consoleStyle: chalk.grey,
+    icon: `[ ]`,
+  },
+};
 
 //helper to capitalize string
-export function capitalize(str: string) : string {
+export function capitalize(str: string): string {
   return str.charAt(0).toUpperCase() + str.slice(1).toLowerCase();
 }
 
 //Console text styling for resource details section
-const resourceDetailSectionStyle = chalk.bgRgb(15, 100, 204)
+const resourceDetailSectionStyle = chalk.bgRgb(15, 100, 204);
 
 //IResourcePaths: Interface for (build/prebuild) paths to local and cloud CFN files
 interface IResourcePaths {
-    localPreBuildCfnFile : string;
-    cloudPreBuildCfnFile : string;
-    localBuildCfnFile : string;
-    cloudBuildCfnFile : string;
+  localPreBuildCfnFile: string;
+  cloudPreBuildCfnFile: string;
+  localBuildCfnFile: string;
+  cloudBuildCfnFile: string;
 }
 
-export function globCFNFilePath( fileFolder : string ){
-  if (fs.existsSync( fileFolder )) {
+export function globCFNFilePath(fileFolder: string) {
+  if (fs.existsSync(fileFolder)) {
     const globOptions: glob.IOptions = {
       absolute: false,
       cwd: fileFolder,
@@ -97,165 +96,173 @@ export function globCFNFilePath( fileFolder : string ){
   throw new Error(`No CloudFormation template found in ${fileFolder}`);
 }
 
-
 export class ResourceDiff {
-    resourceName: string;
-    category : string;
-    provider : string;
-    service: string;
-    resourceFiles : IResourcePaths;
-    localBackendDir : string;
-    cloudBackendDir : string;
-    localTemplate : Template;
-    cloudTemplate : Template;
-    mutationInfo : StackMutationInfo;
+  resourceName: string;
+  category: string;
+  provider: string;
+  service: string;
+  resourceFiles: IResourcePaths;
+  localBackendDir: string;
+  cloudBackendDir: string;
+  localTemplate: Template;
+  cloudTemplate: Template;
+  mutationInfo: StackMutationInfo;
 
-    constructor( category: string, resourceName : string, provider : string, mutationInfo: StackMutationInfo ){
-        this.localBackendDir = pathManager.getBackendDirPath();
-        this.cloudBackendDir = pathManager.getCurrentCloudBackendDirPath();
-        this.resourceName = resourceName;
-        this.category = category;
-        this.provider = this.normalizeProviderForFileNames(provider);
-        this.service = getResourceService(category, resourceName);
-        this.localTemplate = {}; //requires file-access, hence loaded from async methods
-        this.cloudTemplate = {}; //requires file-access, hence loaded from async methods
-        this.mutationInfo = mutationInfo;
-        //Resource Path state
-        const localResourceAbsolutePathFolder = path.normalize(path.join(this.localBackendDir, category, resourceName));
-        const cloudResourceAbsolutePathFolder = path.normalize(path.join(this.cloudBackendDir, category, resourceName));
-        this.resourceFiles = {
-            //Paths using glob for Cfn file and Build file
-            localPreBuildCfnFile : this.safeGlobCFNFilePath(localResourceAbsolutePathFolder),
-            cloudPreBuildCfnFile : this.safeGlobCFNFilePath(cloudResourceAbsolutePathFolder),
-            //Build folder exists for services like GraphQL api which have an additional build step to generate CFN.
-            localBuildCfnFile : this.safeGlobCFNFilePath(path.normalize(path.join(localResourceAbsolutePathFolder, 'build'))),
-            cloudBuildCfnFile : this.safeGlobCFNFilePath(path.normalize(path.join(cloudResourceAbsolutePathFolder, 'build'))),
-          }
-    }
+  constructor(category: string, resourceName: string, provider: string, mutationInfo: StackMutationInfo) {
+    this.localBackendDir = pathManager.getBackendDirPath();
+    this.cloudBackendDir = pathManager.getCurrentCloudBackendDirPath();
+    this.resourceName = resourceName;
+    this.category = category;
+    this.provider = this.normalizeProviderForFileNames(provider);
+    this.service = getResourceService(category, resourceName);
+    this.localTemplate = {}; //requires file-access, hence loaded from async methods
+    this.cloudTemplate = {}; //requires file-access, hence loaded from async methods
+    this.mutationInfo = mutationInfo;
+    //Resource Path state
+    const localResourceAbsolutePathFolder = path.normalize(path.join(this.localBackendDir, category, resourceName));
+    const cloudResourceAbsolutePathFolder = path.normalize(path.join(this.cloudBackendDir, category, resourceName));
+    this.resourceFiles = {
+      //Paths using glob for Cfn file and Build file
+      localPreBuildCfnFile: this.safeGlobCFNFilePath(localResourceAbsolutePathFolder),
+      cloudPreBuildCfnFile: this.safeGlobCFNFilePath(cloudResourceAbsolutePathFolder),
+      //Build folder exists for services like GraphQL api which have an additional build step to generate CFN.
+      localBuildCfnFile: this.safeGlobCFNFilePath(path.normalize(path.join(localResourceAbsolutePathFolder, 'build'))),
+      cloudBuildCfnFile: this.safeGlobCFNFilePath(path.normalize(path.join(cloudResourceAbsolutePathFolder, 'build'))),
+    };
+  }
 
-    //API :View: Print the resource detail status for the given mutation (Create/Update/Delete)
-    public printResourceDetailStatus = async ( mutationInfo : StackMutationInfo ) => {
-      const header = `${ mutationInfo.consoleStyle(mutationInfo.label)}`;
-      const diff = await this.calculateCfnDiff();
-      print.info(`${resourceDetailSectionStyle(`[\u27A5] Resource Stack: ${capitalize(this.category)}/${this.resourceName}`)} : ${header}`);
-      const diffCount = this.printStackDiff( diff, process.stdout );
-      if ( diffCount === 0 ){
-          console.log("No changes  ")
-      }
+  //API :View: Print the resource detail status for the given mutation (Create/Update/Delete)
+  public printResourceDetailStatus = async (mutationInfo: StackMutationInfo) => {
+    const header = `${mutationInfo.consoleStyle(mutationInfo.label)}`;
+    const diff = await this.calculateCfnDiff();
+    print.info(`${resourceDetailSectionStyle(`[\u27A5] Resource Stack: ${capitalize(this.category)}/${this.resourceName}`)} : ${header}`);
+    const diffCount = this.printStackDiff(diff, process.stdout);
+    if (diffCount === 0) {
+      console.log('No changes  ');
     }
+  };
 
-    //API :Data: Calculate the difference in cloudformation templates between local and cloud templates
-    public calculateCfnDiff = async () : Promise<cfnDiff.TemplateDiff>  => {
-      const resourceTemplatePaths = await this.getCfnResourceFilePaths();
-      //set the member template objects
-      this.localTemplate = await this.safeReadCFNTemplate(resourceTemplatePaths.localTemplatePath);
-      this.cloudTemplate = await this.safeReadCFNTemplate(resourceTemplatePaths.cloudTemplatePath);
-
-      //Note!! :- special handling to support multi-env. Currently in multi-env, when new env is created,
-      //we do *Not* delete the cloud-backend folder. Hence this logic will always give no diff for new resources.
-      //TBD: REMOVE this once we delete cloud-backend folder for new envs
-      if ( this.mutationInfo.label == stackMutationType.CREATE.label ){
-        this.cloudTemplate = {} ;//Dont use the parent env's template
-      }
+  //API :Data: Calculate the difference in cloudformation templates between local and cloud templates
+  public calculateCfnDiff = async (): Promise<cfnDiff.TemplateDiff> => {
+    const resourceTemplatePaths = await this.getCfnResourceFilePaths();
+    //set the member template objects
+    this.localTemplate = await this.safeReadCFNTemplate(resourceTemplatePaths.localTemplatePath);
+    this.cloudTemplate = await this.safeReadCFNTemplate(resourceTemplatePaths.cloudTemplatePath);
 
-      //calculate diff of graphs.
-      const diff : cfnDiff.TemplateDiff = cfnDiff.diffTemplate(this.cloudTemplate, this.localTemplate );
-      return diff;
+    //Note!! :- special handling to support multi-env. Currently in multi-env, when new env is created,
+    //we do *Not* delete the cloud-backend folder. Hence this logic will always give no diff for new resources.
+    //TBD: REMOVE this once we delete cloud-backend folder for new envs
+    if (this.mutationInfo.label == stackMutationType.CREATE.label) {
+      this.cloudTemplate = {}; //Dont use the parent env's template
     }
 
-    //helper: wrapper around readCFNTemplate type to handle expressions.
-    private safeReadCFNTemplate = async(filePath : string ) => {
-      try {
-        const templateResult = await readCFNTemplate(filePath);
-        return templateResult.cfnTemplate;
-      } catch (e){
-        return {};
-      }
-    }
+    //calculate diff of graphs.
+    const diff: cfnDiff.TemplateDiff = cfnDiff.diffTemplate(this.cloudTemplate, this.localTemplate);
+    return diff;
+  };
 
-    //helper: Select cloudformation file path from build folder or non build folder.
-    //TBD: Update this function to infer filepath based on the state of the resource.
-    private getCfnResourceFilePaths = async() => {
-      const resourceFilePaths = {
-        localTemplatePath : (checkExist(this.resourceFiles.localBuildCfnFile))?this.resourceFiles.localBuildCfnFile: this.resourceFiles.localPreBuildCfnFile ,
-        cloudTemplatePath : (checkExist(this.resourceFiles.cloudBuildCfnFile))?this.resourceFiles.cloudBuildCfnFile: this.resourceFiles.cloudPreBuildCfnFile
-      }
-      return resourceFilePaths;
+  //helper: wrapper around readCFNTemplate type to handle expressions.
+  private safeReadCFNTemplate = async (filePath: string) => {
+    try {
+      const templateResult = await readCFNTemplate(filePath);
+      return templateResult.cfnTemplate;
+    } catch (e) {
+      return {};
     }
+  };
+
+  //helper: Select cloudformation file path from build folder or non build folder.
+  //TBD: Update this function to infer filepath based on the state of the resource.
+  private getCfnResourceFilePaths = async () => {
+    const resourceFilePaths = {
+      localTemplatePath: checkExist(this.resourceFiles.localBuildCfnFile)
+        ? this.resourceFiles.localBuildCfnFile
+        : this.resourceFiles.localPreBuildCfnFile,
+      cloudTemplatePath: checkExist(this.resourceFiles.cloudBuildCfnFile)
+        ? this.resourceFiles.cloudBuildCfnFile
+        : this.resourceFiles.cloudPreBuildCfnFile,
+    };
+    return resourceFilePaths;
+  };
 
-    //helper: Get category provider from filename
-    private normalizeProviderForFileNames(provider:string):string{
-      //file-names are currently standardized around "cloudformation" not awscloudformation.
-      if ( provider === "awscloudformation"){
-        return CategoryProviders.CLOUDFORMATION
-      } else {
-        return provider;
-      }
+  //helper: Get category provider from filename
+  private normalizeProviderForFileNames(provider: string): string {
+    //file-names are currently standardized around "cloudformation" not awscloudformation.
+    if (provider === 'awscloudformation') {
+      return CategoryProviders.CLOUDFORMATION;
+    } else {
+      return provider;
     }
+  }
 
-    //helper: Convert cloudformation template diff data using CDK api
-    private printStackDiff = ( templateDiff : cfnDiff.TemplateDiff, stream?: cfnDiff.FormatStream ) =>{
-        // filter out 'AWS::CDK::Metadata' since info is not helpful and formatDifferences doesnt know how to format it.
-        if (templateDiff.resources ) {
-          templateDiff.resources = templateDiff.resources.filter(change => {
-            if (!change) { return true; }
-            if (change.newResourceType === 'AWS::CDK::Metadata') { return false; }
-            if (change.oldResourceType === 'AWS::CDK::Metadata') { return false; }
-            return true;
-          });
+  //helper: Convert cloudformation template diff data using CDK api
+  private printStackDiff = (templateDiff: cfnDiff.TemplateDiff, stream?: cfnDiff.FormatStream) => {
+    // filter out 'AWS::CDK::Metadata' since info is not helpful and formatDifferences doesnt know how to format it.
+    if (templateDiff.resources) {
+      templateDiff.resources = templateDiff.resources.filter(change => {
+        if (!change) {
+          return true;
+        }
+        if (change.newResourceType === 'AWS::CDK::Metadata') {
+          return false;
         }
-        if (!templateDiff.isEmpty) {
-          cfnDiff.formatDifferences(stream || process.stderr, templateDiff);
+        if (change.oldResourceType === 'AWS::CDK::Metadata') {
+          return false;
         }
-        return templateDiff.differenceCount;
+        return true;
+      });
     }
+    if (!templateDiff.isEmpty) {
+      cfnDiff.formatDifferences(stream || process.stderr, templateDiff);
+    }
+    return templateDiff.differenceCount;
+  };
 
-    //Search and return the path to cloudformation template in the given folder
-    private safeGlobCFNFilePath( fileFolder : string ){
-      try {
-        return globCFNFilePath(fileFolder);
-      } catch ( e ){
-        return "";
-      }
+  //Search and return the path to cloudformation template in the given folder
+  private safeGlobCFNFilePath(fileFolder: string) {
+    try {
+      return globCFNFilePath(fileFolder);
+    } catch (e) {
+      return '';
     }
+  }
 }
 
-function checkExist( filePath ){
-    const inputTypes = [ 'json', 'yaml', 'yml'] ; //check for existence of any one of the extensions.
-    for( let i = 0 ; i < inputTypes.length ; i++ ){
-      if ( fs.existsSync(`${filePath}.${inputTypes[i]}`) ){
-        return true;
-      }
+function checkExist(filePath) {
+  const inputTypes = ['json', 'yaml', 'yml']; //check for existence of any one of the extensions.
+  for (let i = 0; i < inputTypes.length; i++) {
+    if (fs.existsSync(`${filePath}.${inputTypes[i]}`)) {
+      return true;
     }
-    return false;
+  }
+  return false;
 }
 
 //Interface to store template-diffs for C-D-U resource diffs
 export interface IResourceDiffCollection {
-  updatedDiff : ResourceDiff[]|[],
-  deletedDiff : ResourceDiff[]|[],
-  createdDiff : ResourceDiff[]|[]
+  updatedDiff: ResourceDiff[] | [];
+  deletedDiff: ResourceDiff[] | [];
+  createdDiff: ResourceDiff[] | [];
 }
 
 //Interface to store resource status for each category
 export interface ICategoryStatusCollection {
-  resourcesToBeCreated: any[],
-  resourcesToBeUpdated: any[],
-  resourcesToBeDeleted: any[],
-  resourcesToBeSynced: any[],
-  allResources:any[],
-  tagsUpdated: boolean
+  resourcesToBeCreated: any[];
+  resourcesToBeUpdated: any[];
+  resourcesToBeDeleted: any[];
+  resourcesToBeSynced: any[];
+  rootStackUpdated?: boolean;
+  allResources: any[];
+  tagsUpdated: boolean;
 }
 
 //"CollateResourceDiffs" - Calculates the diffs for the list of resources provided.
 // note:- The mutationInfo may be used for styling in enhanced summary.
-export async function CollateResourceDiffs( resources , mutationInfo : StackMutationInfo  /* create/update/delete */ ){
-    const provider = CategoryProviders.CLOUDFORMATION;
-    let resourceDiffs : ResourceDiff[] = [];
-    for await (const resource of resources) {
-      resourceDiffs.push( new ResourceDiff( resource.category, resource.resourceName, provider, mutationInfo ) );
-    }
-    return resourceDiffs;
+export async function CollateResourceDiffs(resources, mutationInfo: StackMutationInfo /* create/update/delete */) {
+  const provider = CategoryProviders.CLOUDFORMATION;
+  let resourceDiffs: ResourceDiff[] = [];
+  for await (const resource of resources) {
+    resourceDiffs.push(new ResourceDiff(resource.category, resource.resourceName, provider, mutationInfo));
   }
-
-
+  return resourceDiffs;
+}
diff --git a/packages/amplify-cli/src/extensions/amplify-helpers/resource-status.ts b/packages/amplify-cli/src/extensions/amplify-helpers/resource-status.ts
index 9db66ff7322..1ac416c8e4d 100644
--- a/packages/amplify-cli/src/extensions/amplify-helpers/resource-status.ts
+++ b/packages/amplify-cli/src/extensions/amplify-helpers/resource-status.ts
@@ -1,55 +1,51 @@
-
-
+import _ from 'lodash';
 import { print } from './print';
-import { CLOUD_INITIALIZED,  getCloudInitStatus } from './get-cloud-init-status';
-import { ViewResourceTableParams } from "amplify-cli-core";
+import { getEnvInfo } from './get-env-info';
+import { CLOUD_INITIALIZED, getCloudInitStatus } from './get-cloud-init-status';
+import { ViewResourceTableParams } from 'amplify-cli-core';
 import { viewSummaryTable, viewEnvInfo, viewResourceDiffs } from './resource-status-view';
 import { getMultiCategoryStatus, getResourceStatus, getHashForResourceDir } from './resource-status-data';
-import { getEnvInfo } from './get-env-info';
 import chalk from 'chalk';
 
-export { getResourceStatus, getHashForResourceDir }
+export { getResourceStatus, getHashForResourceDir };
 
-export async function showStatusTable( tableViewFilter : ViewResourceTableParams ){
-      const amplifyProjectInitStatus = getCloudInitStatus();
-      const {
-        resourcesToBeCreated,
-        resourcesToBeUpdated,
-        resourcesToBeDeleted,
-        resourcesToBeSynced,
-        allResources,
-        tagsUpdated,
-      } = await getMultiCategoryStatus(tableViewFilter);
+export async function showStatusTable(tableViewFilter: ViewResourceTableParams) {
+  const amplifyProjectInitStatus = getCloudInitStatus();
+  const {
+    resourcesToBeCreated,
+    resourcesToBeUpdated,
+    resourcesToBeDeleted,
+    resourcesToBeSynced,
+    rootStackUpdated,
+    allResources,
+    tagsUpdated,
+  } = await getMultiCategoryStatus(tableViewFilter);
+
+  //1. Display Environment Info
+  if (amplifyProjectInitStatus === CLOUD_INITIALIZED) {
+    viewEnvInfo();
+  }
+  //2. Display Summary Table
+  viewSummaryTable({ resourcesToBeUpdated, resourcesToBeCreated, resourcesToBeDeleted, resourcesToBeSynced, allResources });
+  //3. Display Tags Status
+  if (tagsUpdated) {
+    print.info('\nTag Changes Detected');
+  }
 
-      //1. Display Environment Info
-      if (amplifyProjectInitStatus === CLOUD_INITIALIZED) {
-        viewEnvInfo();
-      }
-      //2. Display Summary Table
-      viewSummaryTable({  resourcesToBeUpdated,
-                          resourcesToBeCreated,
-                          resourcesToBeDeleted,
-                          resourcesToBeSynced,
-                          allResources
-                      });
-      //3. Display Tags Status
-      if (tagsUpdated) {
-        print.info('\nTag Changes Detected');
-      }
+  //4. Display Root Stack Status
+  if (rootStackUpdated) {
+    print.info('Root Stack Changes Detected');
+  }
 
-      //4. Display Detailed Diffs (Cfn/NonCfn)
-      if ( tableViewFilter.verbose ) {
-          await viewResourceDiffs( {  resourcesToBeUpdated,
-                                      resourcesToBeDeleted,
-                                      resourcesToBeCreated } );
-      }
+  //4. Display Detailed Diffs (Cfn/NonCfn)
+  if (tableViewFilter.verbose) {
+    await viewResourceDiffs({ resourcesToBeUpdated, resourcesToBeDeleted, resourcesToBeCreated });
+  }
 
-      const resourceChanged = resourcesToBeCreated.length +
-                              resourcesToBeUpdated.length +
-                              resourcesToBeSynced.length +
-                              resourcesToBeDeleted.length > 0 || tagsUpdated;
+  const resourceChanged =
+    resourcesToBeCreated.length + resourcesToBeUpdated.length + resourcesToBeSynced.length + resourcesToBeDeleted.length > 0 || tagsUpdated;
 
-      return resourceChanged;
+  return resourceChanged;
 }
 
 export async function showResourceTable(category?, resourceName?, filteredResources?) {
@@ -63,6 +59,7 @@ export async function showResourceTable(category?, resourceName?, filteredResour
     resourcesToBeSynced,
     allResources,
     tagsUpdated,
+    rootStackUpdated,
   } = await getResourceStatus(category, resourceName, undefined, filteredResources);
 
   //1. Display Environment Info
@@ -70,19 +67,21 @@ export async function showResourceTable(category?, resourceName?, filteredResour
     viewEnvInfo();
   }
   //2. Display Summary Table
-  viewSummaryTable({  resourcesToBeUpdated,
-                      resourcesToBeCreated,
-                      resourcesToBeDeleted,
-                      resourcesToBeSynced,
-                      allResources
-                  });
+  viewSummaryTable({ resourcesToBeUpdated, resourcesToBeCreated, resourcesToBeDeleted, resourcesToBeSynced, allResources });
   //3. Display Tags Status
   if (tagsUpdated) {
     print.info('\nTag Changes Detected');
   }
 
+  //4. Display root stack Status
+  if (rootStackUpdated) {
+    print.info('\n RootStack Changes Detected');
+  }
+
   const resourceChanged =
-    resourcesToBeCreated.length + resourcesToBeUpdated.length + resourcesToBeSynced.length + resourcesToBeDeleted.length > 0 || tagsUpdated;
+    resourcesToBeCreated.length + resourcesToBeUpdated.length + resourcesToBeSynced.length + resourcesToBeDeleted.length > 0 ||
+    tagsUpdated ||
+    rootStackUpdated;
 
   return resourceChanged;
 }
diff --git a/packages/amplify-cli/src/extensions/amplify-helpers/root-stack-status.ts b/packages/amplify-cli/src/extensions/amplify-helpers/root-stack-status.ts
new file mode 100644
index 00000000000..d2a8f659d89
--- /dev/null
+++ b/packages/amplify-cli/src/extensions/amplify-helpers/root-stack-status.ts
@@ -0,0 +1,35 @@
+import { pathManager } from 'amplify-cli-core';
+import { rootStackFileName } from 'amplify-provider-awscloudformation';
+import { hashElement, HashElementOptions } from 'folder-hash';
+import * as fs from 'fs-extra';
+
+export function getHashForRootStack(dirPath, files?: string[]) {
+  const options: HashElementOptions = {
+    files: {
+      include: files,
+    },
+  };
+
+  return hashElement(dirPath, options).then(result => result.hash);
+}
+
+export async function isRootStackModifiedSinceLastPush(hashFunction): Promise<boolean> {
+  try {
+    const projectPath = pathManager.findProjectRoot();
+    const localBackendDir = pathManager.getRootStackBuildDirPath(projectPath!);
+    const cloudBackendDir = pathManager.getCurrentCloudRootStackDirPath(projectPath!);
+    if (fs.existsSync(localBackendDir)) {
+      const localDirHash = await hashFunction(localBackendDir, ['*.json']);
+      if (fs.existsSync(cloudBackendDir)) {
+        const cloudDirHash = await hashFunction(cloudBackendDir, ['*.json']);
+        return localDirHash !== cloudDirHash;
+      } else {
+        return true;
+      }
+    } else {
+      return false;
+    }
+  } catch (error) {
+    throw new Error('Amplify Project not initialized.');
+  }
+}
diff --git a/packages/amplify-e2e-core/src/init/amplifyPush.ts b/packages/amplify-e2e-core/src/init/amplifyPush.ts
index 6bf71b874fa..e91686a0f23 100644
--- a/packages/amplify-e2e-core/src/init/amplifyPush.ts
+++ b/packages/amplify-e2e-core/src/init/amplifyPush.ts
@@ -15,7 +15,7 @@ export function amplifyPush(cwd: string, testingWithLatestCodebase: boolean = fa
     spawn(getCLIPath(testingWithLatestCodebase), ['status', '-v'], { cwd, stripColors: true, noOutputTimeout: pushTimeoutMS })
       .wait(/.*/)
       .run((err: Error) => {
-        if ( err ){
+        if (err) {
           reject(err);
         }
       });
@@ -251,6 +251,31 @@ export function amplifyPushWithNoChanges(cwd: string, testingWithLatestCodebase:
   return new Promise((resolve, reject) => {
     spawn(getCLIPath(testingWithLatestCodebase), ['push'], { cwd, stripColors: true, noOutputTimeout: pushTimeoutMS })
       .wait('No changes detected')
-      .run((err: Error) => err ? reject(err) : resolve());
+      .run((err: Error) => (err ? reject(err) : resolve()));
+  });
+}
+
+export function amplifyPushOverride(cwd: string, testingWithLatestCodebase: boolean = false): Promise<void> {
+  return new Promise((resolve, reject) => {
+    //Test detailed status
+    spawn(getCLIPath(testingWithLatestCodebase), ['status', '-v'], { cwd, stripColors: true, noOutputTimeout: pushTimeoutMS })
+      .wait(/.*/)
+      .run((err: Error) => {
+        if (err) {
+          reject(err);
+        }
+      });
+    //Test amplify push
+    spawn(getCLIPath(testingWithLatestCodebase), ['push'], { cwd, stripColors: true, noOutputTimeout: pushTimeoutMS })
+      .wait('Are you sure you want to continue?')
+      .sendConfirmYes()
+      .wait(/.*/)
+      .run((err: Error) => {
+        if (!err) {
+          resolve();
+        } else {
+          reject(err);
+        }
+      });
   });
 }
diff --git a/packages/amplify-e2e-core/src/init/index.ts b/packages/amplify-e2e-core/src/init/index.ts
index 3f207ceb65b..b27bca0fddc 100644
--- a/packages/amplify-e2e-core/src/init/index.ts
+++ b/packages/amplify-e2e-core/src/init/index.ts
@@ -4,3 +4,4 @@ export * from './deleteProject';
 export * from './initProjectHelper';
 export * from './pull-headless';
 export * from './adminUI';
+export * from './overrideRootStack';
diff --git a/packages/amplify-e2e-core/src/init/overrideRootStack.ts b/packages/amplify-e2e-core/src/init/overrideRootStack.ts
new file mode 100644
index 00000000000..997c33b9e72
--- /dev/null
+++ b/packages/amplify-e2e-core/src/init/overrideRootStack.ts
@@ -0,0 +1,19 @@
+import { nspawn as spawn, getCLIPath } from '..';
+
+export function amplifyOverrideRoot(cwd: string, settings: {}) {
+  return new Promise((resolve, reject) => {
+    const args = ['override', 'project'];
+
+    spawn(getCLIPath(), args, { cwd, stripColors: true })
+      .wait('Do you want to edit override.ts file now?')
+      .sendConfirmNo()
+      .sendEof()
+      .run((err: Error) => {
+        if (!err) {
+          resolve({});
+        } else {
+          reject(err);
+        }
+      });
+  });
+}
diff --git a/packages/amplify-e2e-tests/overrides/override-root.ts b/packages/amplify-e2e-tests/overrides/override-root.ts
new file mode 100644
index 00000000000..285ea3455cc
--- /dev/null
+++ b/packages/amplify-e2e-tests/overrides/override-root.ts
@@ -0,0 +1,4 @@
+export function overrideProps(props: any): void {
+  props.authRole.roleName = 'mockRole';
+  return props;
+}
diff --git a/packages/amplify-e2e-tests/src/__tests__/init.test.ts b/packages/amplify-e2e-tests/src/__tests__/init.test.ts
index 0c85adf09d4..288c125fc3c 100644
--- a/packages/amplify-e2e-tests/src/__tests__/init.test.ts
+++ b/packages/amplify-e2e-tests/src/__tests__/init.test.ts
@@ -12,8 +12,13 @@ import {
   amplifyInitSandbox,
   getProjectSchema,
   amplifyPush,
+  amplifyOverrideRoot,
+  amplifyPushOverride,
+  createNewProjectDir,
+  deleteProjectDir,
+  getEnvVars,
+  getProjectMeta,
 } from 'amplify-e2e-core';
-import { createNewProjectDir, deleteProjectDir, getEnvVars, getProjectMeta } from 'amplify-e2e-core';
 import { JSONUtilities } from 'amplify-cli-core';
 import { SandboxApp } from '../types/SandboxApp';
 
@@ -24,8 +29,8 @@ describe('amplify init', () => {
   });
 
   afterEach(async () => {
-    await deleteProject(projRoot);
-    deleteProjectDir(projRoot);
+    // await deleteProject(projRoot);
+    // deleteProjectDir(projRoot);
   });
 
   it('should pull sandbox and download schema', async () => {
@@ -151,4 +156,24 @@ describe('amplify init', () => {
 
     fs.writeFileSync(localEnvPath, JSON.stringify(localEnvData, null, 2));
   });
+
+  it.only('should init the project and override root and push', async () => {
+    await initJSProjectWithProfile(projRoot, {});
+    const meta = getProjectMeta(projRoot).providers.awscloudformation;
+    expect(meta.Region).toBeDefined();
+    const { AuthRoleName, UnauthRoleName, UnauthRoleArn, AuthRoleArn, DeploymentBucketName } = meta;
+
+    expect(UnauthRoleName).toBeIAMRoleWithArn(UnauthRoleArn);
+    expect(AuthRoleName).toBeIAMRoleWithArn(AuthRoleArn);
+    expect(DeploymentBucketName).toBeAS3Bucket(DeploymentBucketName);
+
+    // override new env
+    await amplifyOverrideRoot(projRoot, {});
+    const srcOverrideFilePath = path.join(__dirname, '..', '..', 'overrides', 'override-root.ts');
+    const destOverrideFilePath = path.join(projRoot, 'amplify', 'backend', 'awscloudformation', 'override.ts');
+    fs.copyFileSync(srcOverrideFilePath, destOverrideFilePath);
+    await amplifyPushOverride(projRoot);
+    const newEnvMeta = getProjectMeta(projRoot).providers.awscloudformation;
+    expect(newEnvMeta.AuthRoleName).toEqual('mockRole');
+  });
 });
diff --git a/packages/amplify-migration-tests/package.json b/packages/amplify-migration-tests/package.json
index dc9be803854..470aff2b741 100644
--- a/packages/amplify-migration-tests/package.json
+++ b/packages/amplify-migration-tests/package.json
@@ -18,10 +18,12 @@
   "private": true,
   "scripts": {
     "build-tests": "tsc --build tsconfig.tests.json",
-    "migration_v4.0.0": "npm run setup-profile 4.0.0 && jest --testPathIgnorePatterns=auth.deployment.secrets\\|layer-migration --verbose",
+    "migration_v4.0.0": "npm run setup-profile 4.0.0 && jest --testPathIgnorePatterns=auth.deployment.secrets\\|layer-migration| overrides --verbose",
     "migration_v4.30.0_auth": "npm run setup-profile 4.30.0 && jest src/__tests__/migration_tests/auth-deployment-migration/auth.deployment.secrets.test.ts --verbose",
     "migration_v4.28.2_nonmultienv_layers": "npm run setup-profile 4.28.2 && jest src/__tests__/migration_tests/lambda-layer-migration/layer-migration.test.ts --verbose",
     "migration_v4.52.0_multienv_layers": "npm run setup-profile 4.52.0 && jest src/__tests__/migration_tests/lambda-layer-migration/layer-migration.test.ts --verbose",
+    "migration_v6.0.1": "npm run setup-profile 6.0.1 && jest src/__tests__/migration_tests_overrides/ --verbose",
+
     "migration": "npm run setup-profile latest && jest --testPathIgnorePatterns=auth.deployment.secrets\\|layer-migration --verbose",
     "setup-profile": "ts-node ./src/configure_tests.ts"
   },
diff --git a/packages/amplify-migration-tests/src/__tests__/migration_tests/overrides/init-migration.test.ts b/packages/amplify-migration-tests/src/__tests__/migration_tests/overrides/init-migration.test.ts
new file mode 100644
index 00000000000..de5a8ef236b
--- /dev/null
+++ b/packages/amplify-migration-tests/src/__tests__/migration_tests/overrides/init-migration.test.ts
@@ -0,0 +1,43 @@
+import * as fs from 'fs-extra';
+import * as path from 'path';
+import {
+  initJSProjectWithProfile,
+  deleteProject,
+  amplifyOverrideRoot,
+  createNewProjectDir,
+  deleteProjectDir,
+  getProjectMeta,
+  amplifyPushOverride,
+} from 'amplify-e2e-core';
+import { JSONUtilities } from 'amplify-cli-core';
+
+describe('amplify init', () => {
+  let projRoot: string;
+  beforeEach(async () => {
+    projRoot = await createNewProjectDir('init');
+  });
+
+  afterEach(async () => {
+    await deleteProject(projRoot);
+    deleteProjectDir(projRoot);
+  });
+
+  it('should init the project and override root and push', async () => {
+    await initJSProjectWithProfile(projRoot, {});
+    const meta = getProjectMeta(projRoot).providers.awscloudformation;
+    expect(meta.Region).toBeDefined();
+    // turn ON feature flag
+    const cliJsonPath = path.join(projRoot, 'amplify', 'cli.json');
+    const cliJSON = JSONUtilities.readJson(cliJsonPath);
+    const modifiedCliJson = Object.assign(cliJSON, { overrides: { project: true } });
+    JSONUtilities.writeJson(cliJsonPath, modifiedCliJson);
+    // override new env
+    await amplifyOverrideRoot(projRoot, {});
+    const srcOverrideFilePath = path.join(__dirname, '..', '..', 'overrides', 'override-root.ts');
+    const destOverrideFilePath = path.join(projRoot, 'amplify', 'backend', 'awscloudformation', 'override.ts');
+    fs.copyFileSync(srcOverrideFilePath, destOverrideFilePath);
+    await amplifyPushOverride(projRoot);
+    const newEnvMeta = getProjectMeta(projRoot).providers.awscloudformation;
+    expect(newEnvMeta.AuthRoleName).toEqual('mockRole');
+  });
+});
diff --git a/packages/amplify-provider-awscloudformation/amplify-plugin.json b/packages/amplify-provider-awscloudformation/amplify-plugin.json
index 618886f0046..9a51a23bbd9 100644
--- a/packages/amplify-provider-awscloudformation/amplify-plugin.json
+++ b/packages/amplify-provider-awscloudformation/amplify-plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "awscloudformation",
-  "aliases": ["awscfn", "aws", "root"],
+  "aliases": ["awscfn", "aws", "root", "project"],
   "type": "provider",
   "commands": ["configure", "console", "reset-cache", "setupNewUser", "help", "override"],
   "commandAliases": {
diff --git a/packages/amplify-provider-awscloudformation/src/__tests__/commands/override.test.ts b/packages/amplify-provider-awscloudformation/src/__tests__/commands/override.test.ts
new file mode 100644
index 00000000000..8a950a967b0
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/__tests__/commands/override.test.ts
@@ -0,0 +1,57 @@
+import { run } from '../../commands/awscloudformation/override';
+import { $TSContext, FeatureFlags, generateOverrideSkeleton } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
+import * as path from 'path';
+
+jest.mock('amplify-cli-core', () => ({
+  FeatureFlags: {
+    getBoolean: jest.fn(),
+  },
+  generateOverrideSkeleton: jest.fn(),
+}));
+jest.mock('amplify-provider-awscloudformation');
+jest.mock('amplify-prompts', () => ({
+  printer: {
+    info: jest.fn(),
+  },
+}));
+
+jest.mock('fs-extra', () => ({
+  ensureDirSync: jest.fn(),
+  existsSync: jest.fn(),
+  emptyDirSync: jest.fn(),
+}));
+
+describe('run override command for root stack', () => {
+  it('runs override command when FF is OFF', async () => {
+    const context_stub = {
+      amplify: {
+        confirmPrompt: jest.fn().mockResolvedValue(true),
+        invokePluginMethod: jest.fn(),
+      },
+    };
+
+    const context_stub_typed = context_stub as unknown as $TSContext;
+    await run(context_stub_typed);
+    expect(printer.info).toBeCalledTimes(2);
+  });
+
+  it('run override command when FF is ON and awscloudformation exist', async () => {
+    FeatureFlags.getBoolean = jest.fn().mockReturnValue(true);
+    const context_stub = {
+      amplify: {
+        confirmPrompt: jest.fn().mockResolvedValue(true),
+        invokePluginMethod: jest.fn(),
+        pathManager: {
+          getBackendDirPath: jest.fn().mockReturnValue('mydir'),
+        },
+      },
+    };
+
+    const context_stub_typed = context_stub as unknown as $TSContext;
+    await run(context_stub_typed);
+    const mockSrcPath = path.join(__dirname, '..', '..', '..', 'resources', 'overrides-resource');
+    const mockDestPath = path.join('mydir', 'awscloudformation');
+    expect(generateOverrideSkeleton).toBeCalledWith(context_stub_typed, mockSrcPath, mockDestPath);
+  });
+});
diff --git a/packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/__snapshots__/root-stack-builder.test.ts.snap b/packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/__snapshots__/root-stack-builder.test.ts.snap
new file mode 100644
index 00000000000..c50f3f58fff
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/__snapshots__/root-stack-builder.test.ts.snap
@@ -0,0 +1,161 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Check RootStack Template generates root stack Template 1`] = `
+Object {
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Description": "Root Stack for AWS Amplify CLI",
+  "Outputs": Object {
+    "AuthRoleArn": Object {
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "AuthRole",
+          "Arn",
+        ],
+      },
+    },
+    "Region": Object {
+      "Description": "CloudFormation provider root stack Region",
+      "Export": Object {
+        "Name": Object {
+          "Fn::Sub": "\${AWS::StackName}-Region",
+        },
+      },
+      "Value": Object {
+        "Ref": "AWS::Region",
+      },
+    },
+    "StackId": Object {
+      "Description": "CloudFormation provider root stack name",
+      "Export": Object {
+        "Name": Object {
+          "Fn::Sub": "\${AWS::StackName}-StackId",
+        },
+      },
+      "Value": Object {
+        "Ref": "AWS::StackId",
+      },
+    },
+    "StackName": Object {
+      "Description": "CloudFormation provider root stack ID",
+      "Export": Object {
+        "Name": Object {
+          "Fn::Sub": "\${AWS::StackName}-StackName",
+        },
+      },
+      "Value": Object {
+        "Ref": "AWS::StackName",
+      },
+    },
+    "UnAuthRoleArn": Object {
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "UnauthRole",
+          "Arn",
+        ],
+      },
+    },
+  },
+  "Parameters": Object {
+    "AuthRoleName": Object {
+      "Default": "AuthRoleName",
+      "Description": "Name of the common deployment bucket provided by the parent stack",
+      "Type": "String",
+    },
+    "DeploymentBucketName": Object {
+      "Default": "DeploymentBucket",
+      "Description": "Name of the common deployment bucket provided by the parent stack",
+      "Type": "String",
+    },
+    "UnauthRoleName": Object {
+      "Default": "UnAuthRoleName",
+      "Description": "Name of the common deployment bucket provided by the parent stack",
+      "Type": "String",
+    },
+  },
+  "Resources": Object {
+    "AuthRole": Object {
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": "sts:AssumeRoleWithWebIdentity",
+              "Effect": "Deny",
+              "Principal": Object {
+                "Federated": "cognito-identity.amazonaws.com",
+              },
+              "Sid": "",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "RoleName": Object {
+          "Ref": "AuthRoleName",
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+    "DeploymentBucket": Object {
+      "DeletionPolicy": "Retain",
+      "Properties": Object {
+        "BucketName": Object {
+          "Ref": "DeploymentBucketName",
+        },
+      },
+      "Type": "AWS::S3::Bucket",
+      "UpdateReplacePolicy": "Retain",
+    },
+    "UnauthRole": Object {
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": "sts:AssumeRoleWithWebIdentity",
+              "Effect": "Deny",
+              "Principal": Object {
+                "Federated": "cognito-identity.amazonaws.com",
+              },
+              "Sid": "",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "RoleName": Object {
+          "Ref": "UnauthRoleName",
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+  },
+}
+`;
+
+exports[`Check RootStack Template rootstack template generated by constructor 1`] = `
+Object {
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Description": "Root Stack for AWS Amplify CLI",
+}
+`;
+
+exports[`Check RootStack Template rootstack template generated by constructor with some parameters 1`] = `
+Object {
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Description": "Root Stack for AWS Amplify CLI",
+  "Parameters": Object {
+    "AuthRoleName": Object {
+      "Default": "AuthRoleName",
+      "Description": "Name of the common deployment bucket provided by the parent stack",
+      "Type": "String",
+    },
+    "DeploymentBucketName": Object {
+      "Default": "DeploymentBucket",
+      "Description": "Name of the common deployment bucket provided by the parent stack",
+      "Type": "String",
+    },
+    "UnauthRoleName": Object {
+      "Default": "UnAuthRoleName",
+      "Description": "Name of the common deployment bucket provided by the parent stack",
+      "Type": "String",
+    },
+  },
+}
+`;
diff --git a/packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/__snapshots__/root-stack-transform.test.ts.snap b/packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/__snapshots__/root-stack-transform.test.ts.snap
new file mode 100644
index 00000000000..163f74e39d1
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/__snapshots__/root-stack-transform.test.ts.snap
@@ -0,0 +1,151 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Check RootStack Template Generated rootstack template during init 1`] = `
+Object {
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Description": "Root Stack for AWS Amplify CLI",
+  "Outputs": Object {
+    "AuthRoleArn": Object {
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "AuthRole",
+          "Arn",
+        ],
+      },
+    },
+    "AuthRoleName": Object {
+      "Value": Object {
+        "Ref": "AuthRoleName",
+      },
+    },
+    "DeploymentBucketName": Object {
+      "Description": "CloudFormation provider root stack deployment bucket name",
+      "Export": Object {
+        "Name": Object {
+          "Fn::Sub": "\${AWS::StackName}-DeploymentBucketName",
+        },
+      },
+      "Value": Object {
+        "Ref": "DeploymentBucketName",
+      },
+    },
+    "Region": Object {
+      "Description": "CloudFormation provider root stack Region",
+      "Export": Object {
+        "Name": Object {
+          "Fn::Sub": "\${AWS::StackName}-Region",
+        },
+      },
+      "Value": Object {
+        "Ref": "AWS::Region",
+      },
+    },
+    "StackId": Object {
+      "Description": "CloudFormation provider root stack name",
+      "Export": Object {
+        "Name": Object {
+          "Fn::Sub": "\${AWS::StackName}-StackId",
+        },
+      },
+      "Value": Object {
+        "Ref": "AWS::StackId",
+      },
+    },
+    "StackName": Object {
+      "Description": "CloudFormation provider root stack ID",
+      "Export": Object {
+        "Name": Object {
+          "Fn::Sub": "\${AWS::StackName}-StackName",
+        },
+      },
+      "Value": Object {
+        "Ref": "AWS::StackName",
+      },
+    },
+    "UnAuthRoleArn": Object {
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "UnauthRole",
+          "Arn",
+        ],
+      },
+    },
+    "UnauthRoleName": Object {
+      "Value": Object {
+        "Ref": "UnauthRoleName",
+      },
+    },
+  },
+  "Parameters": Object {
+    "AuthRoleName": Object {
+      "Default": "AuthRoleName",
+      "Description": "Name of the common deployment bucket provided by the parent stack",
+      "Type": "String",
+    },
+    "DeploymentBucketName": Object {
+      "Default": "DeploymentBucket",
+      "Description": "Name of the common deployment bucket provided by the parent stack",
+      "Type": "String",
+    },
+    "UnauthRoleName": Object {
+      "Default": "UnAuthRoleName",
+      "Description": "Name of the common deployment bucket provided by the parent stack",
+      "Type": "String",
+    },
+  },
+  "Resources": Object {
+    "AuthRole": Object {
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": "sts:AssumeRoleWithWebIdentity",
+              "Effect": "Deny",
+              "Principal": Object {
+                "Federated": "cognito-identity.amazonaws.com",
+              },
+              "Sid": "",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "RoleName": Object {
+          "Ref": "AuthRoleName",
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+    "DeploymentBucket": Object {
+      "DeletionPolicy": "Retain",
+      "Properties": Object {
+        "BucketName": Object {
+          "Ref": "DeploymentBucketName",
+        },
+      },
+      "Type": "AWS::S3::Bucket",
+      "UpdateReplacePolicy": "Retain",
+    },
+    "UnauthRole": Object {
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": "sts:AssumeRoleWithWebIdentity",
+              "Effect": "Deny",
+              "Principal": Object {
+                "Federated": "cognito-identity.amazonaws.com",
+              },
+              "Sid": "",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "RoleName": Object {
+          "Ref": "UnauthRoleName",
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+  },
+}
+`;
diff --git a/packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/root-stack-builder.test.ts b/packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/root-stack-builder.test.ts
new file mode 100644
index 00000000000..ce79cb8c369
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/root-stack-builder.test.ts
@@ -0,0 +1,200 @@
+import { SynthUtils } from '@aws-cdk/assert';
+import * as cdk from '@aws-cdk/core';
+import { AmplifyRootStack } from '../../root-stack-builder/root-stack-builder';
+
+jest.mock('../../root-stack-builder/stack-synthesizer');
+
+describe('Check RootStack Template', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+  test('rootstack template generated by constructor', () => {
+    const app = new cdk.App();
+    let mocksynth: cdk.IStackSynthesizer;
+    const stack = new AmplifyRootStack(app, 'rootStack', { synthesizer: mocksynth });
+    expect(SynthUtils.toCloudFormation(stack)).toMatchSnapshot();
+  });
+
+  test('rootstack template generated by constructor with some parameters', () => {
+    const app = new cdk.App();
+    let mocksynth: cdk.IStackSynthesizer;
+    const stack = new AmplifyRootStack(app, 'rootStack', { synthesizer: mocksynth });
+
+    stack.addCfnParameter(
+      {
+        type: 'String',
+        description: 'Name of the common deployment bucket provided by the parent stack',
+        default: 'DeploymentBucket',
+      },
+      'DeploymentBucketName',
+    );
+
+    stack.addCfnParameter(
+      {
+        type: 'String',
+        description: 'Name of the common deployment bucket provided by the parent stack',
+        default: 'AuthRoleName',
+      },
+      'AuthRoleName',
+    );
+
+    stack.addCfnParameter(
+      {
+        type: 'String',
+        description: 'Name of the common deployment bucket provided by the parent stack',
+        default: 'UnAuthRoleName',
+      },
+      'UnauthRoleName',
+    );
+    expect(SynthUtils.toCloudFormation(stack)).toMatchSnapshot();
+  });
+
+  test('adding same logicalId parameter should throw error', () => {
+    const app = new cdk.App();
+    let mocksynth: cdk.IStackSynthesizer;
+    const stack = new AmplifyRootStack(app, 'rootStack', { synthesizer: mocksynth });
+
+    stack.addCfnParameter(
+      {
+        type: 'String',
+        description: 'Name of the common deployment bucket provided by the parent stack',
+        default: 'AuthRoleName',
+      },
+      'AuthRoleName',
+    );
+
+    expect(() =>
+      stack.addCfnParameter(
+        {
+          type: 'String',
+          description: 'Name of the common deployment bucket provided by the parent stack',
+          default: 'AuthRoleName',
+        },
+        'AuthRoleName',
+      ),
+    ).toThrow('logical Id already Exists');
+  });
+
+  test(' adding two resources with same logicalId throw error', () => {
+    const app = new cdk.App();
+    let mocksynth: cdk.IStackSynthesizer;
+    const stack = new AmplifyRootStack(app, 'rootStack', { synthesizer: mocksynth });
+
+    stack.addCfnParameter(
+      {
+        type: 'String',
+        description: 'Name of the common deployment bucket provided by the parent stack',
+        default: 'DeploymentBucket',
+      },
+      'DeploymentBucketName',
+    );
+
+    // Add Outputs
+    stack.addCfnOutput(
+      {
+        description: 'CloudFormation provider root stack Region',
+        value: cdk.Fn.ref('AWS::Region'),
+        exportName: cdk.Fn.sub('${AWS::StackName}-Region'),
+      },
+      'Region',
+    );
+
+    stack.addCfnOutput(
+      {
+        description: 'CloudFormation provider root stack ID',
+        value: cdk.Fn.ref('AWS::StackName'),
+        exportName: cdk.Fn.sub('${AWS::StackName}-StackName'),
+      },
+      'StackName',
+    );
+
+    expect(() =>
+      stack.addCfnOutput(
+        {
+          description: 'CloudFormation provider root stack deployment bucket name',
+          value: cdk.Fn.ref('DeploymentBucketName'),
+          exportName: cdk.Fn.sub('${AWS::StackName}-DeploymentBucketName'),
+        },
+        'DeploymentBucketName',
+      ),
+    ).toThrow(`There is already a Construct with name 'DeploymentBucketName' in AmplifyRootStack`);
+  });
+
+  test('generates root stack Template', async () => {
+    const app = new cdk.App();
+    let mocksynth: cdk.IStackSynthesizer;
+    const stack = new AmplifyRootStack(app, 'rootStack', { synthesizer: mocksynth });
+
+    stack.addCfnParameter(
+      {
+        type: 'String',
+        description: 'Name of the common deployment bucket provided by the parent stack',
+        default: 'DeploymentBucket',
+      },
+      'DeploymentBucketName',
+    );
+
+    stack.addCfnParameter(
+      {
+        type: 'String',
+        description: 'Name of the common deployment bucket provided by the parent stack',
+        default: 'AuthRoleName',
+      },
+      'AuthRoleName',
+    );
+
+    stack.addCfnParameter(
+      {
+        type: 'String',
+        description: 'Name of the common deployment bucket provided by the parent stack',
+        default: 'UnAuthRoleName',
+      },
+      'UnauthRoleName',
+    );
+
+    // Add Outputs
+    stack.addCfnOutput(
+      {
+        description: 'CloudFormation provider root stack Region',
+        value: cdk.Fn.ref('AWS::Region'),
+        exportName: cdk.Fn.sub('${AWS::StackName}-Region'),
+      },
+      'Region',
+    );
+
+    stack.addCfnOutput(
+      {
+        description: 'CloudFormation provider root stack ID',
+        value: cdk.Fn.ref('AWS::StackName'),
+        exportName: cdk.Fn.sub('${AWS::StackName}-StackName'),
+      },
+      'StackName',
+    );
+
+    stack.addCfnOutput(
+      {
+        description: 'CloudFormation provider root stack name',
+        value: cdk.Fn.ref('AWS::StackId'),
+        exportName: cdk.Fn.sub('${AWS::StackName}-StackId'),
+      },
+      'StackId',
+    );
+
+    stack.addCfnOutput(
+      {
+        value: cdk.Fn.getAtt('AuthRole', 'Arn').toString(),
+      },
+      'AuthRoleArn',
+    );
+
+    stack.addCfnOutput(
+      {
+        value: cdk.Fn.getAtt('UnauthRole', 'Arn').toString(),
+      },
+      'UnAuthRoleArn',
+    );
+
+    await stack.generateRootStackResources();
+    expect(SynthUtils.toCloudFormation(stack)).toMatchSnapshot();
+  });
+});
diff --git a/packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/root-stack-transform.test.ts b/packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/root-stack-transform.test.ts
new file mode 100644
index 00000000000..370dea2d639
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/__tests__/root-stack-builder/root-stack-transform.test.ts
@@ -0,0 +1,22 @@
+import { AmplifyRootStackTransform } from '../../root-stack-builder/root-stack-transform';
+import { $TSContext } from 'amplify-cli-core';
+
+jest.mock('amplify-cli-core');
+
+describe('Check RootStack Template', () => {
+  it('Generated rootstack template during init', async () => {
+    const context_stub = {
+      input: {
+        command: 'init',
+      },
+    };
+
+    const context_stub_typed = context_stub as unknown as $TSContext;
+    // CFN transform for Root stack
+    const resourceName = 'awscloudformation';
+
+    const rootTransform = new AmplifyRootStackTransform(resourceName);
+    const mock_template = await rootTransform.transform(context_stub_typed);
+    expect(mock_template).toMatchSnapshot();
+  });
+});
diff --git a/packages/amplify-provider-awscloudformation/src/attach-backend.js b/packages/amplify-provider-awscloudformation/src/attach-backend.js
index 1c0f661718c..2c0a482ffe9 100644
--- a/packages/amplify-provider-awscloudformation/src/attach-backend.js
+++ b/packages/amplify-provider-awscloudformation/src/attach-backend.js
@@ -15,7 +15,7 @@ const { resolveAppId } = require('./utils/resolve-appId');
 const { adminLoginFlow } = require('./admin-login');
 const { fileLogger } = require('./utils/aws-logger');
 const logger = fileLogger('attach-backend');
-import { downloadHooks } from './utils/hooks-manager';
+const { downloadHooks } = require('./utils/hooks-manager');
 
 async function run(context) {
   let appId;
diff --git a/packages/amplify-provider-awscloudformation/src/commands/awscloudformation/override.ts b/packages/amplify-provider-awscloudformation/src/commands/awscloudformation/override.ts
index d504f9f0390..e5986921376 100644
--- a/packages/amplify-provider-awscloudformation/src/commands/awscloudformation/override.ts
+++ b/packages/amplify-provider-awscloudformation/src/commands/awscloudformation/override.ts
@@ -3,17 +3,34 @@
 */
 
 import path from 'path';
-import { generateOverrideSkeleton, $TSContext } from 'amplify-cli-core';
+import { generateOverrideSkeleton, $TSContext, FeatureFlags } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
+import * as fs from 'fs-extra';
 
 const subcommand = 'override';
 
 export const name = 'overrides';
 
 export const run = async (context: $TSContext) => {
-  const backendDir = context.amplify.pathManager.getBackendDirPath();
+  if (FeatureFlags.getBoolean('overrides.project')) {
+    const backendDir = context.amplify.pathManager.getBackendDirPath();
 
-  const destPath = path.normalize(path.join(backendDir, 'awscloudformation'));
-  const srcPath = path.normalize(path.join(__dirname, '..', '..', '..', 'resources', 'overrides-resource'));
-
-  await generateOverrideSkeleton(context, srcPath, destPath);
+    const destPath = path.join(backendDir, 'awscloudformation');
+    fs.ensureDirSync(destPath);
+    const srcPath = path.join(__dirname, '..', '..', '..', 'resources', 'overrides-resource');
+    // removing runtime old root cfn stack
+    // no need for rollback since these files will be autogenerated after push
+    const oldRootStackFile = path.join(destPath, 'nested-cloudformation-stack.yml');
+    if (fs.existsSync(oldRootStackFile)) {
+      fs.unlinkSync(oldRootStackFile);
+    }
+    await generateOverrideSkeleton(context, srcPath, destPath);
+  } else {
+    printer.info('Project level overrides is currently not turned on. In cli.json file please include the following:');
+    printer.info(`{
+      override: {
+         project: true
+      }
+    }`);
+  }
 };
diff --git a/packages/amplify-provider-awscloudformation/src/index.ts b/packages/amplify-provider-awscloudformation/src/index.ts
index eca6984e9fa..0957f3b10ea 100644
--- a/packages/amplify-provider-awscloudformation/src/index.ts
+++ b/packages/amplify-provider-awscloudformation/src/index.ts
@@ -36,7 +36,13 @@ import { updateEnv } from './update-env';
 
 import { uploadHooksDirectory } from './utils/hooks-manager';
 
+export const cfnRootStackFileName = 'root-cloudformation-stack.json';
+export { storeRootStackTemplate } from './initializer';
 import { transformResourceWithOverrides } from './override-manager';
+export { transformResourceWithOverrides } from './override-manager';
+import { rootStackFileName } from './push-resources';
+export { rootStackFileName } from './push-resources';
+export { AmplifyRootStackTemplate } from './root-stack-builder';
 
 function init(context) {
   return initializer.run(context);
@@ -162,4 +168,5 @@ module.exports = {
   updateEnv,
   uploadHooksDirectory,
   transformResourceWithOverrides,
+  rootStackFileName,
 };
diff --git a/packages/amplify-provider-awscloudformation/src/initializer.ts b/packages/amplify-provider-awscloudformation/src/initializer.ts
index d6c735b02fe..5c55d14104b 100644
--- a/packages/amplify-provider-awscloudformation/src/initializer.ts
+++ b/packages/amplify-provider-awscloudformation/src/initializer.ts
@@ -1,9 +1,10 @@
-import { $TSContext } from 'amplify-cli-core';
+import { $TSContext, FeatureFlags, Template, pathManager, PathConstants, stateManager, JSONUtilities } from 'amplify-cli-core';
 import _ from 'lodash';
+import { transformRootStack } from './override-manager';
+import { rootStackFileName } from './push-resources';
 
 const moment = require('moment');
 const path = require('path');
-const { pathManager, PathConstants, stateManager, JSONUtilities } = require('amplify-cli-core');
 const glob = require('glob');
 const archiver = require('./utils/archiver');
 const fs = require('fs-extra');
@@ -20,7 +21,6 @@ const { prePushCfnTemplateModifier } = require('./pre-push-cfn-processor/pre-pus
 const logger = fileLogger('attach-backend');
 const { configurePermissionsBoundaryForInit } = require('./permissions-boundary/permissions-boundary');
 const { uploadHooksDirectory } = require('./utils/hooks-manager');
-
 export async function run(context) {
   await configurationManager.init(context);
   if (!context.exeInfo || context.exeInfo.isNewEnv) {
@@ -43,19 +43,25 @@ export async function run(context) {
     };
     const { amplifyAppId, verifiedStackName, deploymentBucketName } = await amplifyServiceManager.init(amplifyServiceParams);
 
+    // start root stack builder and deploy
+
+    // moved cfn build to next its builder
     stackName = verifiedStackName;
     const Tags = context.amplify.getTags(context);
 
     const authRoleName = `${stackName}-authRole`;
     const unauthRoleName = `${stackName}-unauthRole`;
 
-    const rootStack = JSONUtilities.readJson(initTemplateFilePath);
+    const rootStack = JSONUtilities.readJson<Template>(initTemplateFilePath);
+
     await prePushCfnTemplateModifier(rootStack);
+
     // Track Amplify Console generated stacks
     if (!!process.env.CLI_DEV_INTERNAL_DISABLE_AMPLIFY_APP_DELETION) {
       rootStack.Description = 'Root Stack for AWS Amplify Console';
     }
 
+    // deploy steps
     const params = {
       StackName: stackName,
       Capabilities: ['CAPABILITY_NAMED_IAM', 'CAPABILITY_AUTO_EXPAND'],
@@ -165,6 +171,9 @@ function cloneCLIJSONForNewEnvironment(context) {
 export async function onInitSuccessful(context) {
   configurationManager.onInitSuccessful(context);
   if (context.exeInfo.isNewEnv) {
+    if (FeatureFlags.getBoolean('overrides.project')) {
+      await storeRootStackTemplate(context);
+    }
     context = await storeCurrentCloudBackend(context);
     await storeArtifactsForAmplifyService(context);
     await uploadHooksDirectory(context);
@@ -172,6 +181,27 @@ export async function onInitSuccessful(context) {
   return context;
 }
 
+export const storeRootStackTemplate = async (context: $TSContext, template?: Template) => {
+  // generate template again as the folder structure was not created when root stack was initiaized
+  if (template === undefined) {
+    template = await transformRootStack(context);
+    await prePushCfnTemplateModifier(template);
+  }
+
+  // RootStack deployed to backend/awscloudformation/build
+  const projectRoot = pathManager.findProjectRoot();
+  const rootStackBackendBuildDir = pathManager.getRootStackBuildDirPath(projectRoot);
+  const rootStackCloudBackendBuildDir = pathManager.getCurrentCloudRootStackDirPath(projectRoot);
+
+  fs.ensureDirSync(rootStackBackendBuildDir);
+  const rootStackBackendFilePath = path.join(rootStackBackendBuildDir, rootStackFileName);
+  const rootStackCloudBackendFilePath = path.join(rootStackCloudBackendBuildDir, rootStackFileName);
+
+  JSONUtilities.writeJson(rootStackBackendFilePath, template);
+  // copy the awscloudformation backend to #current-cloud-backend
+  fs.copySync(rootStackBackendFilePath, rootStackCloudBackendFilePath);
+};
+
 function storeCurrentCloudBackend(context) {
   const zipFilename = '#current-cloud-backend.zip';
   const backendDir = context.amplify.pathManager.getBackendDirPath();
diff --git a/packages/amplify-provider-awscloudformation/src/override-manager/index.ts b/packages/amplify-provider-awscloudformation/src/override-manager/index.ts
index d2520bd864f..d69fa3dd4b2 100644
--- a/packages/amplify-provider-awscloudformation/src/override-manager/index.ts
+++ b/packages/amplify-provider-awscloudformation/src/override-manager/index.ts
@@ -1 +1,13 @@
+import { $TSContext, Template } from 'amplify-cli-core';
+import { AmplifyRootStackTransform } from '../root-stack-builder';
+
 export * from './transform-resource';
+
+export const transformRootStack = async (context: $TSContext): Promise<Template> => {
+  try {
+    const resourceName = 'awscloudformation';
+    return new AmplifyRootStackTransform(resourceName).transform(context);
+  } catch (error) {
+    throw new Error(error);
+  }
+};
diff --git a/packages/amplify-provider-awscloudformation/src/override-manager/transform-resource.ts b/packages/amplify-provider-awscloudformation/src/override-manager/transform-resource.ts
index ab370daa7c6..0c55ba038ac 100644
--- a/packages/amplify-provider-awscloudformation/src/override-manager/transform-resource.ts
+++ b/packages/amplify-provider-awscloudformation/src/override-manager/transform-resource.ts
@@ -1,6 +1,6 @@
 import { $TSContext, FeatureFlags, IAmplifyResource } from 'amplify-cli-core';
-//import { transformRootStack } from '.';
 import { printer } from 'amplify-prompts';
+import { transformRootStack } from '.';
 /**
  *
  * @param context
@@ -11,21 +11,20 @@ export async function transformResourceWithOverrides(context: $TSContext, resour
   if (flags['no-override']) {
     return;
   }
-  if (resource && FeatureFlags.getBoolean(`overrides.${resource.category}`)) {
-    try {
-      // Each Category will implement transformCategoryStack function to start transformation process
+  try {
+    if (resource && FeatureFlags.getBoolean(`overrides.${resource.category}`)) {
       const { transformCategoryStack } = await import(`@aws-amplify/amplify-category-${resource.category}`);
       if (transformCategoryStack) {
         return transformCategoryStack(context, resource);
       } else {
         printer.info('Overrides functionality is not impleented for this category');
       }
-    } catch (err) {
-      return;
-    }
-  } else {
-    if (FeatureFlags.getBoolean('overrides.project')) {
-      //await transformRootStack(context);
+    } else {
+      if (FeatureFlags.getBoolean('overrides.project')) {
+        await transformRootStack(context);
+      }
     }
+  } catch (err) {
+    return;
   }
 }
diff --git a/packages/amplify-provider-awscloudformation/src/push-resources.ts b/packages/amplify-provider-awscloudformation/src/push-resources.ts
index f940187e574..3f82426b2bf 100644
--- a/packages/amplify-provider-awscloudformation/src/push-resources.ts
+++ b/packages/amplify-provider-awscloudformation/src/push-resources.ts
@@ -17,6 +17,7 @@ import {
   DeploymentStepState,
   DeploymentStepStatus,
   readCFNTemplate,
+  Template,
 } from 'amplify-cli-core';
 import ora from 'ora';
 import { S3 } from './aws-utils/aws-s3';
@@ -36,7 +37,7 @@ import { uploadAuthTriggerFiles } from './upload-auth-trigger-files';
 import archiver from './utils/archiver';
 import amplifyServiceManager from './amplify-service-manager';
 import { DeploymentManager, DeploymentStep, DeploymentOp, DeploymentStateManager, runIterativeRollback } from './iterative-deployment';
-import { Fn, Template } from 'cloudform-types';
+import { Fn } from 'cloudform-types';
 import { getGqlUpdatedResource } from './graphql-transformer/utils';
 import { isAmplifyAdminApp } from './utils/admin-helpers';
 import { fileLogger } from './utils/aws-logger';
@@ -47,6 +48,8 @@ import { preProcessCFNTemplate } from './pre-push-cfn-processor/cfn-pre-processo
 import { AUTH_TRIGGER_STACK, AUTH_TRIGGER_TEMPLATE } from './utils/upload-auth-trigger-template';
 import { ensureValidFunctionModelDependencies } from './utils/remove-dependent-function';
 import { legacyLayerMigration, postPushLambdaLayerCleanup, prePushLambdaLayerPrompt } from './lambdaLayerInvocations';
+import { storeRootStackTemplate } from './initializer';
+import { transformRootStack } from './override-manager';
 
 const logger = fileLogger('push-resources');
 
@@ -54,11 +57,12 @@ const logger = fileLogger('push-resources');
 const ApiServiceNameElasticContainer = 'ElasticContainer';
 
 const spinner = ora('Updating resources in the cloud. This may take a few minutes...');
-const rootStackFileName = 'rootStackTemplate.json';
-const nestedStackFileName = 'nested-cloudformation-stack.yml';
+
 const optionalBuildDirectoryName = 'build';
 const cfnTemplateGlobPattern = '*template*.+(yaml|yml|json)';
 const parametersJson = 'parameters.json';
+export const defaultRootStackFileName = 'rootStackTemplate.json';
+export const rootStackFileName = 'root-cloudformation-stack.json';
 
 const deploymentInProgressErrorMessage = (context: $TSContext) => {
   context.print.error('A deployment is in progress.');
@@ -80,6 +84,7 @@ export async function run(context: $TSContext, resourceDefinition: $TSObject) {
       resourcesToBeDeleted,
       tagsUpdated,
       allResources,
+      rootStackUpdated,
     } = resourceDefinition;
     const cloudformationMeta = context.amplify.getProjectMeta().providers.awscloudformation;
     const {
@@ -209,6 +214,7 @@ export async function run(context: $TSContext, resourceDefinition: $TSObject) {
       resourcesToBeUpdated.length > 0 ||
       resourcesToBeDeleted.length > 0 ||
       tagsUpdated ||
+      rootStackUpdated ||
       context.exeInfo.forcePush
     ) {
       // If there is an API change, there will be one deployment step. But when there needs an iterative update the step count is > 1
@@ -222,12 +228,12 @@ export async function run(context: $TSContext, resourceDefinition: $TSObject) {
 
         // generate nested stack
         const backEndDir = pathManager.getBackendDirPath();
-        const nestedStackFilepath = path.normalize(path.join(backEndDir, providerName, nestedStackFileName));
-        await generateAndUploadRootStack(context, nestedStackFilepath, nestedStackFileName);
+        const rootStackFilepath = path.normalize(path.join(backEndDir, providerName, rootStackFileName));
+        await generateAndUploadRootStack(context, rootStackFilepath, rootStackFileName);
 
         // Use state manager to do the final deployment. The final deployment include not just API change but the whole Amplify Project
         const finalStep: DeploymentOp = {
-          stackTemplatePathOrUrl: nestedStackFileName,
+          stackTemplatePathOrUrl: rootStackFileName,
           tableNames: [],
           stackName: cloudformationMeta.StackName,
           parameters: {
@@ -266,6 +272,11 @@ export async function run(context: $TSContext, resourceDefinition: $TSObject) {
 
         try {
           await updateCloudFormationNestedStack(context, nestedStack, resourcesToBeCreated, resourcesToBeUpdated);
+          if (FeatureFlags.getBoolean('Overrides.project')) {
+            storeRootStackTemplate(context, nestedStack);
+            // if the only root stack updates, function is called with empty resources . this fn copies amplifyMeta and backend Config to #current-cloud-backend
+            context.amplify.updateamplifyMetaAfterPush([]);
+          }
         } catch (err) {
           if (err?.name === 'ValidationError' && err?.message === 'No updates are to be performed.') {
             return;
@@ -667,12 +678,11 @@ async function updateCloudFormationNestedStack(
   resourcesToBeUpdated: $TSAny,
 ) {
   const backEndDir = pathManager.getBackendDirPath();
-  const nestedStackFilepath = path.normalize(path.join(backEndDir, providerName, nestedStackFileName));
-
-  JSONUtilities.writeJson(nestedStackFilepath, nestedStack);
-
-  const transformedStackPath = await preProcessCFNTemplate(nestedStackFilepath);
-
+  const projectRoot = pathManager.findProjectRoot();
+  const rootStackFilePath = path.join(pathManager.getRootStackBuildDirPath(projectRoot), rootStackFileName);
+  // deploy new nested stack to disk
+  JSONUtilities.writeJson(rootStackFilePath, nestedStack);
+  const transformedStackPath = await preProcessCFNTemplate(rootStackFilePath);
   const cfnItem = await new Cloudformation(context, generateUserAgentAction(resourcesToBeCreated, resourcesToBeUpdated));
   const providerDirectory = path.normalize(path.join(backEndDir, providerName));
 
@@ -822,15 +832,42 @@ async function formNestedStack(
   serviceName?: string,
   skipEnv?: boolean,
 ) {
-  const initTemplateFilePath = path.join(__dirname, '..', 'resources', rootStackFileName);
-  const nestedStack = JSONUtilities.readJson<Template>(initTemplateFilePath);
+  let rootStack;
+  // CFN transform for Root stack
+  rootStack = await transformRootStack(context);
+
+  // get the {deploymentBucketName , AuthRoleName , UnAuthRole from overridded data}
+
+  const metaToBeUpdated = {
+    DeploymentBucketName: rootStack.Resources.DeploymentBucket.Properties.BucketName,
+    AuthRoleName: rootStack.Resources.AuthRole.Properties.RoleName,
+    UnauthRoleName: rootStack.Resources.UnauthRole.Properties.RoleName,
+  };
+  // sanitize this data if needed
+  for (const key of Object.keys(metaToBeUpdated)) {
+    if (typeof metaToBeUpdated[key] === 'object' && 'Ref' in metaToBeUpdated[key]) {
+      delete metaToBeUpdated[key];
+    }
+  }
+  // update amplify meta with updated root stack Info
+  if (Object.keys(metaToBeUpdated).length) {
+    context.amplify.updateProvideramplifyMeta(providerName, metaToBeUpdated);
+    //update teamProviderInfo
+    const { envName } = context.amplify.getEnvInfo();
+    const projectPath = pathManager.findProjectRoot();
+    const teamProviderInfo = stateManager.getTeamProviderInfo(projectPath);
+    const tpiResourceParams: $TSAny = _.get(teamProviderInfo, [envName, 'awscloudformation'], {});
+    _.assign(tpiResourceParams, metaToBeUpdated);
+    _.set(teamProviderInfo, [envName, 'awscloudformation'], tpiResourceParams);
+    stateManager.setTeamProviderInfo(projectPath, teamProviderInfo);
+  }
 
   // Track Amplify Console generated stacks
   try {
     const amplifyMeta = stateManager.getMeta();
     const appId = amplifyMeta.providers[providerName].AmplifyAppId;
     if ((await isAmplifyAdminApp(appId)).isAdminApp) {
-      nestedStack.Description = 'Root Stack for AWS Amplify Console';
+      rootStack.Description = 'Root Stack for AWS Amplify Console';
     }
   } catch (err) {
     console.info('App not deployed yet.');
@@ -869,7 +906,7 @@ async function formNestedStack(
       }
     });
 
-    nestedStack.Resources[APIGW_AUTH_STACK_LOGICAL_ID] = stack;
+    rootStack.Resources[APIGW_AUTH_STACK_LOGICAL_ID] = stack;
   }
 
   if (AuthTriggerTemplateURL) {
@@ -912,22 +949,22 @@ async function formNestedStack(
       });
     });
 
-    nestedStack.Resources[AUTH_TRIGGER_STACK] = stack;
+    rootStack.Resources[AUTH_TRIGGER_STACK] = stack;
   }
 
   if (NetworkStackS3Url) {
-    nestedStack.Resources[NETWORK_STACK_LOGICAL_ID] = {
+    rootStack.Resources[NETWORK_STACK_LOGICAL_ID] = {
       Type: 'AWS::CloudFormation::Stack',
       Properties: {
         TemplateURL: NetworkStackS3Url,
       },
     };
 
-    nestedStack.Resources.DeploymentBucket.Properties['VersioningConfiguration'] = {
+    rootStack.Resources.DeploymentBucket.Properties['VersioningConfiguration'] = {
       Status: 'Enabled',
     };
 
-    nestedStack.Resources.DeploymentBucket.Properties['LifecycleConfiguration'] = {
+    rootStack.Resources.DeploymentBucket.Properties['LifecycleConfiguration'] = {
       Rules: [
         {
           ExpirationInDays: 7,
@@ -941,7 +978,7 @@ async function formNestedStack(
 
   let categories = Object.keys(amplifyMeta);
 
-  categories = categories.filter(category => category !== 'provider');
+  categories = categories.filter(category => category !== 'providers');
 
   categories.forEach(category => {
     const resources = Object.keys(amplifyMeta[category]);
@@ -1031,14 +1068,8 @@ async function formNestedStack(
         // If auth is imported check the parameters section of the nested template
         // and if it has auth or unauth role arn or name or userpool id, then inject it from the
         // imported auth resource's properties
-        const {
-          imported,
-          userPoolId,
-          authRoleArn,
-          authRoleName,
-          unauthRoleArn,
-          unauthRoleName,
-        } = context.amplify.getImportedAuthProperties(context);
+        const { imported, userPoolId, authRoleArn, authRoleName, unauthRoleArn, unauthRoleName } =
+          context.amplify.getImportedAuthProperties(context);
 
         if (category !== 'auth' && resourceDetails.service !== 'Cognito' && imported) {
           if (parameters.AuthCognitoUserPoolId) {
@@ -1065,7 +1096,7 @@ async function formNestedStack(
         if (resourceDetails.providerMetadata) {
           templateURL = resourceDetails.providerMetadata.s3TemplateURL;
 
-          nestedStack.Resources[resourceKey] = {
+          rootStack.Resources[resourceKey] = {
             Type: 'AWS::CloudFormation::Stack',
             Properties: {
               TemplateURL: templateURL,
@@ -1085,12 +1116,12 @@ async function formNestedStack(
       const authParameters = loadResourceParameters(context, 'auth', authResourceName);
 
       if (authParameters.identityPoolName) {
-        updateIdPRolesInNestedStack(nestedStack, authResourceName);
+        updateIdPRolesInNestedStack(rootStack, authResourceName);
       }
     }
   }
 
-  return nestedStack;
+  return rootStack;
 }
 
 function updateIdPRolesInNestedStack(nestedStack: $TSAny, authResourceName: $TSAny) {
diff --git a/packages/amplify-provider-awscloudformation/src/root-stack-builder/index.ts b/packages/amplify-provider-awscloudformation/src/root-stack-builder/index.ts
new file mode 100644
index 00000000000..e6611d7b1ba
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/root-stack-builder/index.ts
@@ -0,0 +1,2 @@
+export { AmplifyRootStackTransform } from './root-stack-transform';
+export { AmplifyRootStackTemplate } from './types';
diff --git a/packages/amplify-provider-awscloudformation/src/root-stack-builder/root-stack-builder.ts b/packages/amplify-provider-awscloudformation/src/root-stack-builder/root-stack-builder.ts
new file mode 100644
index 00000000000..ff38fbd5b90
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/root-stack-builder/root-stack-builder.ts
@@ -0,0 +1,190 @@
+import * as cdk from '@aws-cdk/core';
+import * as s3 from '@aws-cdk/aws-s3';
+import * as iam from '@aws-cdk/aws-iam';
+import { AmplifyRootStackTemplate } from './types';
+import { IStackSynthesizer, ISynthesisSession } from '@aws-cdk/core';
+
+const CFN_TEMPLATE_FORMAT_VERSION = '2010-09-09';
+const ROOT_CFN_DESCRIPTION = 'Root Stack for AWS Amplify CLI';
+
+export type AmplifyRootStackProps = {
+  synthesizer: IStackSynthesizer;
+};
+
+export class AmplifyRootStack extends cdk.Stack implements AmplifyRootStackTemplate {
+  _scope: cdk.Construct;
+  deploymentBucket: s3.CfnBucket;
+  authRole: iam.CfnRole;
+  unauthRole: iam.CfnRole;
+  private _cfnParameterMap: Map<string, cdk.CfnParameter> = new Map();
+
+  constructor(scope: cdk.Construct, id: string, props: AmplifyRootStackProps) {
+    super(scope, id, props);
+    this._scope = scope;
+    this.templateOptions.templateFormatVersion = CFN_TEMPLATE_FORMAT_VERSION;
+    this.templateOptions.description = ROOT_CFN_DESCRIPTION;
+  }
+
+  /**
+   *
+   * @param props :cdk.CfnOutputProps
+   * @param logicalId: : lodicalId of the Resource
+   */
+  addCfnOutput(props: cdk.CfnOutputProps, logicalId: string): void {
+    try {
+      new cdk.CfnOutput(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnMapping(props: cdk.CfnMappingProps, logicalId: string): void {
+    try {
+      new cdk.CfnMapping(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnCondition(props: cdk.CfnConditionProps, logicalId: string): void {
+    try {
+      new cdk.CfnCondition(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnResource(props: cdk.CfnResourceProps, logicalId: string): void {
+    try {
+      new cdk.CfnResource(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnParameter(props: cdk.CfnParameterProps, logicalId: string): void {
+    try {
+      if (this._cfnParameterMap.has(logicalId)) {
+        throw new Error('logical Id already Exists');
+      }
+      this._cfnParameterMap.set(logicalId, new cdk.CfnParameter(this, logicalId, props));
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  getCfnParameter(logicalId: string): cdk.CfnParameter {
+    if (this._cfnParameterMap.has(logicalId)) {
+      return this._cfnParameterMap.get(logicalId);
+    } else {
+      throw new Error(`Cfn Parameter with LogicalId ${logicalId} doesnt exist`);
+    }
+  }
+
+  generateRootStackResources = async () => {
+    this.deploymentBucket = new s3.CfnBucket(this, 'DeploymentBucket', {
+      bucketName: this._cfnParameterMap.get('DeploymentBucketName').valueAsString,
+    });
+
+    this.deploymentBucket.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN);
+
+    this.authRole = new iam.CfnRole(this, 'AuthRole', {
+      roleName: this._cfnParameterMap.get('AuthRoleName').valueAsString,
+      assumeRolePolicyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Sid: '',
+            Effect: 'Deny',
+            Principal: {
+              Federated: 'cognito-identity.amazonaws.com',
+            },
+            Action: 'sts:AssumeRoleWithWebIdentity',
+          },
+        ],
+      },
+    });
+
+    this.unauthRole = new iam.CfnRole(this, 'UnauthRole', {
+      roleName: this._cfnParameterMap.get('UnauthRoleName').valueAsString,
+      assumeRolePolicyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Sid: '',
+            Effect: 'Deny',
+            Principal: {
+              Federated: 'cognito-identity.amazonaws.com',
+            },
+            Action: 'sts:AssumeRoleWithWebIdentity',
+          },
+        ],
+      },
+    });
+  };
+
+  // add Function for Custom Resource in Root stack
+  /**
+   *
+   * @param _
+   * @returns
+   */
+  public renderCloudFormationTemplate = (_: ISynthesisSession): string => {
+    return JSON.stringify(this._toCloudFormation(), undefined, 2);
+  };
+}
+
+/**
+ * additional class to merge CFN parameters and CFN outputs as cdk doesnt allow same logical ID of constructs in same stack
+ */
+export class AmplifyRootStackOutputs extends cdk.Stack implements AmplifyRootStackTemplate {
+  constructor(scope: cdk.Construct, id: string, props: AmplifyRootStackProps) {
+    super(scope, id, props);
+  }
+  deploymentBucket?: s3.CfnBucket;
+  authRole?: iam.CfnRole;
+  unauthRole?: iam.CfnRole;
+
+  addCfnParameter(props: cdk.CfnParameterProps, logicalId: string): void {
+    throw new Error('Method not implemented.');
+  }
+  addCfnOutput(props: cdk.CfnOutputProps, logicalId: string): void {
+    try {
+      new cdk.CfnOutput(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+  addCfnMapping(props: cdk.CfnMappingProps, logicalId: string): void {
+    throw new Error('Method not implemented.');
+  }
+  addCfnCondition(props: cdk.CfnConditionProps, logicalId: string): void {
+    throw new Error('Method not implemented.');
+  }
+  addCfnResource(props: cdk.CfnResourceProps, logicalId: string): void {
+    throw new Error('Method not implemented.');
+  }
+
+  public renderCloudFormationTemplate = (_: ISynthesisSession): string => {
+    return JSON.stringify((this as any)._toCloudFormation(), undefined, 2);
+  };
+}
diff --git a/packages/amplify-provider-awscloudformation/src/root-stack-builder/root-stack-transform.ts b/packages/amplify-provider-awscloudformation/src/root-stack-builder/root-stack-transform.ts
new file mode 100644
index 00000000000..ab0e4791afa
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/root-stack-builder/root-stack-transform.ts
@@ -0,0 +1,215 @@
+import { AmplifyRootStackTemplate } from './types';
+import { $TSContext, CFNTemplateFormat, Template, pathManager, writeCFNTemplate, buildOverrideDir } from 'amplify-cli-core';
+import { AmplifyRootStack, AmplifyRootStackOutputs } from './root-stack-builder';
+import { RootStackSythesizer } from './stack-synthesizer';
+import { App } from '@aws-cdk/core';
+import * as cdk from '@aws-cdk/core';
+import * as path from 'path';
+import * as amplifyPrinter from 'amplify-prompts';
+
+export class AmplifyRootStackTransform {
+  private app: App | undefined;
+  private _rootTemplateObj: AmplifyRootStack; // Props to modify Root stack data
+  private _synthesizer: RootStackSythesizer;
+  private _synthesizerOutputs: RootStackSythesizer;
+  private _rootTemplateObjOutputs: AmplifyRootStackOutputs;
+  private _resourceName: string;
+
+  constructor(resourceName: string) {
+    this._resourceName = resourceName;
+    this._synthesizer = new RootStackSythesizer();
+    this.app = new App();
+    this._synthesizerOutputs = new RootStackSythesizer();
+  }
+
+  public async transform(context: $TSContext): Promise<Template> {
+    // generate cfn Constructs and AmplifyRootStackTemplate object to get overridden
+    await this.generateRootStackTemplate();
+
+    // apply override on Amplify Object having CDK Constructs for Root Stack
+    if (context.input.command !== 'init') {
+      await this.applyOverride();
+    }
+
+    // generate CFN template
+    const template: Template = await this.synthesizeTemplates();
+
+    // save stack
+    if (context.input.command !== 'init') {
+      await this.saveBuildFiles(context, template);
+    }
+    return template;
+  }
+
+  private applyOverride = async () => {
+    const backendDir = pathManager.getBackendDirPath();
+    const overrideFilePath = path.join(backendDir, this._resourceName);
+    const isBuild = await buildOverrideDir(backendDir, overrideFilePath).catch(error => {
+      amplifyPrinter.printer.warn(`Skipping build as ${error.message}`);
+      return false;
+    });
+    // skip if packageManager or override.ts not found
+    if (isBuild) {
+      const { overrideProps } = await import(path.join(overrideFilePath, 'build', 'override.js')).catch(error => {
+        amplifyPrinter.formatter.list([
+          'No override File Found',
+          `To override ${this._resourceName} run amplify override auth ${this._resourceName} `,
+        ]);
+        return undefined;
+      });
+
+      // pass stack object
+      const rootStackTemplateObj = this._rootTemplateObj as AmplifyRootStackTemplate;
+      //TODO: Check Script Options
+      if (typeof overrideProps === 'function' && overrideProps) {
+        try {
+          this._rootTemplateObj = overrideProps(rootStackTemplateObj);
+
+          //The vm module enables compiling and running code within V8 Virtual Machine contexts. The vm module is not a security mechanism. Do not use it to run untrusted code.
+          // const script = new vm.Script(overrideCode);
+          // script.runInContext(vm.createContext(cognitoStackTemplateObj));
+          return;
+        } catch (error) {
+          throw new Error(error);
+        }
+      }
+    }
+  };
+
+  /**
+   * Generates Root stack Template
+   * @returns CFN Template
+   */
+  private generateRootStackTemplate = async () => {
+    this._rootTemplateObj = new AmplifyRootStack(this.app, 'AmplifyRootStack', { synthesizer: this._synthesizer });
+
+    this._rootTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+        description: 'Name of the common deployment bucket provided by the parent stack',
+        default: 'DeploymentBucket',
+      },
+      'DeploymentBucketName',
+    );
+
+    this._rootTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+        description: 'Name of the common deployment bucket provided by the parent stack',
+        default: 'AuthRoleName',
+      },
+      'AuthRoleName',
+    );
+
+    this._rootTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+        description: 'Name of the common deployment bucket provided by the parent stack',
+        default: 'UnAuthRoleName',
+      },
+      'UnauthRoleName',
+    );
+
+    // Add Outputs
+    this._rootTemplateObj.addCfnOutput(
+      {
+        description: 'CloudFormation provider root stack Region',
+        value: cdk.Fn.ref('AWS::Region'),
+        exportName: cdk.Fn.sub('${AWS::StackName}-Region'),
+      },
+      'Region',
+    );
+
+    this._rootTemplateObj.addCfnOutput(
+      {
+        description: 'CloudFormation provider root stack ID',
+        value: cdk.Fn.ref('AWS::StackName'),
+        exportName: cdk.Fn.sub('${AWS::StackName}-StackName'),
+      },
+      'StackName',
+    );
+
+    this._rootTemplateObj.addCfnOutput(
+      {
+        description: 'CloudFormation provider root stack name',
+        value: cdk.Fn.ref('AWS::StackId'),
+        exportName: cdk.Fn.sub('${AWS::StackName}-StackId'),
+      },
+      'StackId',
+    );
+
+    this._rootTemplateObj.addCfnOutput(
+      {
+        value: cdk.Fn.getAtt('AuthRole', 'Arn').toString(),
+      },
+      'AuthRoleArn',
+    );
+
+    this._rootTemplateObj.addCfnOutput(
+      {
+        value: cdk.Fn.getAtt('UnauthRole', 'Arn').toString(),
+      },
+      'UnAuthRoleArn',
+    );
+
+    await this._rootTemplateObj.generateRootStackResources();
+
+    // add another stack as above stack duplicate logical Ids
+    this._rootTemplateObjOutputs = new AmplifyRootStackOutputs(this.app, 'AmplifyRootStackOutputs', {
+      synthesizer: this._synthesizerOutputs,
+    });
+    this._rootTemplateObjOutputs.addCfnOutput(
+      {
+        description: 'CloudFormation provider root stack deployment bucket name',
+        value: cdk.Fn.ref('DeploymentBucketName'),
+        exportName: cdk.Fn.sub('${AWS::StackName}-DeploymentBucketName'),
+      },
+      'DeploymentBucketName',
+    );
+
+    this._rootTemplateObjOutputs.addCfnOutput(
+      {
+        value: cdk.Fn.ref('AuthRoleName'),
+      },
+      'AuthRoleName',
+    );
+
+    this._rootTemplateObjOutputs.addCfnOutput(
+      {
+        value: cdk.Fn.ref('UnauthRoleName'),
+      },
+      'UnauthRoleName',
+    );
+  };
+
+  /**
+   *
+   * @returns return CFN templates sunthesized by app
+   */
+  private synthesizeTemplates = async (): Promise<Template> => {
+    this.app?.synth();
+    const templates = this._synthesizer.collectStacks();
+    const templatesOutput = this._synthesizerOutputs.collectStacks();
+    const cfnRootStack: Template = templates.get('AmplifyRootStack');
+    const cfnRootStackOutputs: Template = templatesOutput.get('AmplifyRootStackOutputs');
+    Object.assign(cfnRootStack.Outputs, cfnRootStackOutputs.Outputs);
+    return cfnRootStack;
+  };
+
+  private saveBuildFiles = async (context: $TSContext, template: Template) => {
+    const rootStackFileName = `root-cloudformation-stack.json`;
+    const rootstackFilePath = path.join(pathManager.getBackendDirPath(), this._resourceName, 'build', rootStackFileName);
+    // write CFN template
+    writeCFNTemplate(template, rootstackFilePath, {
+      templateFormat: CFNTemplateFormat.JSON,
+    });
+  };
+
+  public getRootStack(): AmplifyRootStack {
+    if (this._rootTemplateObj != null) {
+      return this._rootTemplateObj;
+    } else {
+      throw new Error('Root Stack Template doesnt exist');
+    }
+  }
+}
diff --git a/packages/amplify-provider-awscloudformation/src/root-stack-builder/stack-synthesizer.ts b/packages/amplify-provider-awscloudformation/src/root-stack-builder/stack-synthesizer.ts
new file mode 100644
index 00000000000..7a951e90c2e
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/root-stack-builder/stack-synthesizer.ts
@@ -0,0 +1,45 @@
+import { ISynthesisSession, Stack, LegacyStackSynthesizer } from '@aws-cdk/core';
+import { Template } from 'amplify-cli-core';
+import { AmplifyRootStack, AmplifyRootStackOutputs } from './root-stack-builder';
+
+export class RootStackSythesizer extends LegacyStackSynthesizer {
+  private stacks: Map<string, Stack> = new Map();
+  private static readonly stackAssets: Map<string, Template> = new Map();
+
+  protected synthesizeStackTemplate(stack: Stack, session: ISynthesisSession): void {
+    if (stack instanceof AmplifyRootStackOutputs) {
+      this.addStack(stack);
+      const template = stack.renderCloudFormationTemplate(session) as string;
+      const templateName = stack.node.id;
+      this.setStackAsset(templateName, template);
+      return;
+    } else if (stack instanceof AmplifyRootStack) {
+      this.addStack(stack);
+      const template = stack.renderCloudFormationTemplate(session) as string;
+      const templateName = stack.node.id;
+      this.setStackAsset(templateName, template);
+      return;
+    } else {
+      throw new Error('Error synthesizing the template. Expected Stack to be either instance of AmplifyRootStack');
+    }
+  }
+
+  setStackAsset(templateName: string, template: string): void {
+    RootStackSythesizer.stackAssets.set(templateName, JSON.parse(template));
+  }
+
+  collectStacks(): Map<string, Template> {
+    return new Map(RootStackSythesizer.stackAssets.entries());
+  }
+
+  addStack(stack: Stack) {
+    this.stacks.set(stack.node.id, stack);
+  }
+
+  getStack = (stackName: string): Stack => {
+    if (this.stacks.has(stackName)) {
+      return this.stacks.get(stackName)!;
+    }
+    throw new Error(`Stack ${stackName} is not created`);
+  };
+}
diff --git a/packages/amplify-provider-awscloudformation/src/root-stack-builder/types.ts b/packages/amplify-provider-awscloudformation/src/root-stack-builder/types.ts
new file mode 100644
index 00000000000..a17a277b78b
--- /dev/null
+++ b/packages/amplify-provider-awscloudformation/src/root-stack-builder/types.ts
@@ -0,0 +1,15 @@
+import * as cdk from '@aws-cdk/core';
+import * as s3 from '@aws-cdk/aws-s3';
+import * as iam from '@aws-cdk/aws-iam';
+
+export interface AmplifyRootStackTemplate {
+  deploymentBucket?: s3.CfnBucket;
+  authRole?: iam.CfnRole;
+  unauthRole?: iam.CfnRole;
+
+  addCfnParameter(props: cdk.CfnParameterProps, logicalId: string): void;
+  addCfnOutput(props: cdk.CfnOutputProps, logicalId: string): void;
+  addCfnMapping(props: cdk.CfnMappingProps, logicalId: string): void;
+  addCfnCondition(props: cdk.CfnConditionProps, logicalId: string): void;
+  addCfnResource(props: cdk.CfnResourceProps, logicalId: string): void;
+}
diff --git a/packages/amplify-provider-awscloudformation/src/utility-functions.js b/packages/amplify-provider-awscloudformation/src/utility-functions.js
index 5c3adb8141b..51335cb158b 100644
--- a/packages/amplify-provider-awscloudformation/src/utility-functions.js
+++ b/packages/amplify-provider-awscloudformation/src/utility-functions.js
@@ -71,6 +71,7 @@ module.exports = {
     for (const resource of options.resourcesToBuild) {
       await transformResourceWithOverrides(context, resource);
     }
+    await transformResourceWithOverrides(context);
   },
 
   newSecret: async (context, options) => {

From 1b2cd077d1557943a5d2cf83e46495e031059cce Mon Sep 17 00:00:00 2001
From: akshbhu <39866697+akshbhu@users.noreply.github.com>
Date: Tue, 28 Sep 2021 19:30:09 -0700
Subject: [PATCH 3/6] feat: adding rootstack types to overrides helper package
 (#8298)

---
 packages/amplify-cli-overrides-helper/src/index.ts            | 4 +++-
 .../src/aws-utils/aws-ssm.ts                                  | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/packages/amplify-cli-overrides-helper/src/index.ts b/packages/amplify-cli-overrides-helper/src/index.ts
index d8284ac82d6..2052642562c 100644
--- a/packages/amplify-cli-overrides-helper/src/index.ts
+++ b/packages/amplify-cli-overrides-helper/src/index.ts
@@ -1,5 +1,7 @@
 import { printer } from 'amplify-prompts';
 
+import { AmplifyRootStackTemplate } from 'amplify-provider-awscloudformation';
+
 function getProjectInfo(): void {
   printer.info('Hello from the skeleton of get project info');
 }
@@ -8,4 +10,4 @@ function addDependency(): void {
   printer.info('Hello from the skeleton of add dependency');
 }
 
-export { getProjectInfo, addDependency };
+export { getProjectInfo, addDependency, AmplifyRootStackTemplate };
diff --git a/packages/amplify-provider-awscloudformation/src/aws-utils/aws-ssm.ts b/packages/amplify-provider-awscloudformation/src/aws-utils/aws-ssm.ts
index 27310487aa2..cdabc87d44b 100644
--- a/packages/amplify-provider-awscloudformation/src/aws-utils/aws-ssm.ts
+++ b/packages/amplify-provider-awscloudformation/src/aws-utils/aws-ssm.ts
@@ -1,6 +1,7 @@
 import { $TSContext, $TSObject } from 'amplify-cli-core';
 import { AwsSecrets, loadConfiguration } from '../configuration-manager';
 import aws from './aws.js';
+import * as AWS from 'aws-sdk';
 
 export class SSM {
   private static instance: SSM;

From 89b4f0a1990217b9fdc2b0987e79d9ce02b5ed80 Mon Sep 17 00:00:00 2001
From: Kaustav Ghosh <kaustav.ghosh19@gmail.com>
Date: Mon, 4 Oct 2021 09:21:20 -0700
Subject: [PATCH 4/6] feat: ddb overrides and flow refactor

* feat: ddb overrides

* feat: add migration logic

* fix: remove older files post migration

* fix: address PR comments

* fix: remove inquirer and use amplify prompts instead

Co-authored-by: Ghosh <kaustavg@3c22fb229ff6.ant.amazon.com>
---
 .../amplify-plugin.json                       |   2 +-
 .../amplify-category-storage/package.json     |  16 +-
 .../resources/genInputSchema.ts               |  17 +
 .../overrides-resource/DynamoDB/override.ts   |   7 +
 .../overrides-resource/DynamoDB/package.json  |  18 +
 .../overrides-resource/DynamoDB/tsconfig.json |  12 +
 .../DynamoDB/tsconfig.resource.json           |  13 +
 .../overrides-resource/S3/override.ts         |   6 +
 .../overrides-resource/S3/package.json        |  18 +
 .../overrides-resource/S3/tsconfig.json       |  12 +
 .../S3/tsconfig.resource.json                 |  13 +
 .../DynamoDB/DynamoDBCLIInputs.schema.json    |  64 ++
 .../schemas/S3/S3UserInputs.schema.json       |  50 +
 .../src/commands/storage/override.ts          |  83 ++
 .../amplify-category-storage/src/index.ts     | 152 +--
 .../cdk-stack-builder/ddb-stack-builder.ts    | 188 ++++
 .../cdk-stack-builder/ddb-stack-transform.ts  | 225 +++++
 .../cdk-stack-builder/s3-stack-builder.ts     |   5 +
 .../cdk-stack-builder/types.ts                |  20 +
 .../awscloudformation/cfn-template-utils.ts   |   9 +-
 ...amoDb-defaults.js => dynamoDb-defaults.ts} |   4 +-
 .../{s3-defaults.js => s3-defaults.ts}        |   4 +-
 .../dynamoDB-user-input-types.ts              |  41 +
 .../s3-user-input-types.ts                    |  28 +
 .../dynamoDB-input-state.ts                   | 165 ++++
 .../dynamoDb-walkthrough.js                   | 931 ------------------
 .../dynamoDb-walkthrough.ts                   | 784 +++++++++++++++
 .../s3-user-input-state.ts                    | 162 +++
 packages/amplify-cli-core/src/cliConstants.ts |   2 +-
 .../src/feature-flags/featureFlags.ts         |   6 +
 .../src/state-manager/pathManager.ts          |  11 +
 packages/amplify-cli/amplify-plugin.json      |   3 +-
 packages/amplify-cli/package.json             |   4 +-
 33 files changed, 2072 insertions(+), 1003 deletions(-)
 create mode 100644 packages/amplify-category-storage/resources/genInputSchema.ts
 create mode 100644 packages/amplify-category-storage/resources/overrides-resource/DynamoDB/override.ts
 create mode 100644 packages/amplify-category-storage/resources/overrides-resource/DynamoDB/package.json
 create mode 100644 packages/amplify-category-storage/resources/overrides-resource/DynamoDB/tsconfig.json
 create mode 100644 packages/amplify-category-storage/resources/overrides-resource/DynamoDB/tsconfig.resource.json
 create mode 100644 packages/amplify-category-storage/resources/overrides-resource/S3/override.ts
 create mode 100644 packages/amplify-category-storage/resources/overrides-resource/S3/package.json
 create mode 100644 packages/amplify-category-storage/resources/overrides-resource/S3/tsconfig.json
 create mode 100644 packages/amplify-category-storage/resources/overrides-resource/S3/tsconfig.resource.json
 create mode 100644 packages/amplify-category-storage/resources/schemas/DynamoDB/DynamoDBCLIInputs.schema.json
 create mode 100644 packages/amplify-category-storage/resources/schemas/S3/S3UserInputs.schema.json
 create mode 100644 packages/amplify-category-storage/src/commands/storage/override.ts
 create mode 100644 packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-builder.ts
 create mode 100644 packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform.ts
 create mode 100644 packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/s3-stack-builder.ts
 create mode 100644 packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/types.ts
 rename packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/{dynamoDb-defaults.js => dynamoDb-defaults.ts} (80%)
 rename packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/{s3-defaults.js => s3-defaults.ts} (91%)
 create mode 100644 packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthrough-types/dynamoDB-user-input-types.ts
 create mode 100644 packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthrough-types/s3-user-input-types.ts
 create mode 100644 packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state.ts
 delete mode 100644 packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.js
 create mode 100644 packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.ts
 create mode 100644 packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/s3-user-input-state.ts

diff --git a/packages/amplify-category-storage/amplify-plugin.json b/packages/amplify-category-storage/amplify-plugin.json
index 6eabe87cf19..b46d4d9565b 100644
--- a/packages/amplify-category-storage/amplify-plugin.json
+++ b/packages/amplify-category-storage/amplify-plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "storage",
   "type": "category",
-  "commands": ["add", "import", "console", "push", "remove", "update", "help"],
+  "commands": ["add", "import", "console", "push", "remove", "update", "help", "override"],
   "commandAliases": {
     "configure": "update"
   },
diff --git a/packages/amplify-category-storage/package.json b/packages/amplify-category-storage/package.json
index bd53c0c6e62..865941812ec 100644
--- a/packages/amplify-category-storage/package.json
+++ b/packages/amplify-category-storage/package.json
@@ -1,6 +1,6 @@
 {
-  "name": "amplify-category-storage",
-  "version": "2.12.9",
+  "name": "@aws-amplify/amplify-category-storage",
+  "version": "1.0.0",
   "description": "amplify-cli storage plugin",
   "repository": {
     "type": "git",
@@ -15,7 +15,8 @@
     "build": "tsc",
     "test": "jest",
     "clean": "rimraf lib tsconfig.tsbuildinfo",
-    "watch": "tsc -w"
+    "watch": "tsc -w",
+    "generateSchemas": "ts-node ./resources/genInputSchema.ts"
   },
   "keywords": [
     "amplify",
@@ -27,6 +28,9 @@
     "amplify-util-import": "1.5.12",
     "chalk": "^4.1.1",
     "cloudform-types": "^4.2.0",
+    "@aws-cdk/aws-s3": "~1.124.0",
+    "@aws-cdk/core": "~1.124.0",
+    "@aws-cdk/aws-dynamodb": "~1.124.0",
     "enquirer": "^2.3.6",
     "fs-extra": "^8.1.0",
     "inquirer": "^7.3.3",
@@ -52,6 +56,10 @@
       "json",
       "node"
     ],
-    "collectCoverage": true
+    "collectCoverage": true,
+    "coverageReporters": [
+      "json",
+      "html"
+    ]
   }
 }
diff --git a/packages/amplify-category-storage/resources/genInputSchema.ts b/packages/amplify-category-storage/resources/genInputSchema.ts
new file mode 100644
index 00000000000..20e8eb40016
--- /dev/null
+++ b/packages/amplify-category-storage/resources/genInputSchema.ts
@@ -0,0 +1,17 @@
+import { TypeDef, CLIInputSchemaGenerator } from 'amplify-cli-core';
+
+//ResourceProvider TypeDefs
+const DDBStorageTypeDef: TypeDef = {
+  typeName: 'DynamoDBCLIInputs',
+  service: 'DynamoDB',
+};
+const S3StorageTypeDef: TypeDef = {
+  typeName: 'S3UserInputs',
+  service: 'S3',
+};
+
+// Defines the type names and the paths to the TS files that define them
+const storageCategoryTypeDefs: TypeDef[] = [DDBStorageTypeDef];
+
+const schemaGenerator = new CLIInputSchemaGenerator(storageCategoryTypeDefs);
+schemaGenerator.generateJSONSchemas(); //convert CLI input data into json schemas.
diff --git a/packages/amplify-category-storage/resources/overrides-resource/DynamoDB/override.ts b/packages/amplify-category-storage/resources/overrides-resource/DynamoDB/override.ts
new file mode 100644
index 00000000000..95ad315252c
--- /dev/null
+++ b/packages/amplify-category-storage/resources/overrides-resource/DynamoDB/override.ts
@@ -0,0 +1,7 @@
+/* Add Amplify Helper dependencies     */
+
+/* TODO: Need to change props to Root-Stack specific props when props are ready */
+export function overrideProps(props: any) {
+  /* TODO: Add snippet of how to override in comments */
+  return props;
+}
diff --git a/packages/amplify-category-storage/resources/overrides-resource/DynamoDB/package.json b/packages/amplify-category-storage/resources/overrides-resource/DynamoDB/package.json
new file mode 100644
index 00000000000..1601dccfc02
--- /dev/null
+++ b/packages/amplify-category-storage/resources/overrides-resource/DynamoDB/package.json
@@ -0,0 +1,18 @@
+{
+    "name": "overrides-for-root-stack",
+    "version": "1.0.0",
+    "description": "",
+    "scripts": {
+      "build": "tsc",
+      "watch": "tsc -w",
+      "test": "echo \"Error: no test specified\" && exit 1"
+    },
+    "dependencies": {
+      "@types/fs-extra": "^9.0.11",
+      "fs-extra": "^9.1.0"
+    },
+    "devDependencies": {
+      "typescript": "^4.2.4"
+    }
+  }
+  
\ No newline at end of file
diff --git a/packages/amplify-category-storage/resources/overrides-resource/DynamoDB/tsconfig.json b/packages/amplify-category-storage/resources/overrides-resource/DynamoDB/tsconfig.json
new file mode 100644
index 00000000000..f48614cbf6b
--- /dev/null
+++ b/packages/amplify-category-storage/resources/overrides-resource/DynamoDB/tsconfig.json
@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "es6",
+    "module": "commonjs",
+    "strict": false, 
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "outDir": "build"
+  }
+}
+  
\ No newline at end of file
diff --git a/packages/amplify-category-storage/resources/overrides-resource/DynamoDB/tsconfig.resource.json b/packages/amplify-category-storage/resources/overrides-resource/DynamoDB/tsconfig.resource.json
new file mode 100644
index 00000000000..6504da80283
--- /dev/null
+++ b/packages/amplify-category-storage/resources/overrides-resource/DynamoDB/tsconfig.resource.json
@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "es6",
+    "module": "commonjs",
+    "strict": false,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "outDir": "./",
+    "rootDir": "../"
+  },
+  "include": ["../**/*"]
+}
diff --git a/packages/amplify-category-storage/resources/overrides-resource/S3/override.ts b/packages/amplify-category-storage/resources/overrides-resource/S3/override.ts
new file mode 100644
index 00000000000..c02cee5ebd4
--- /dev/null
+++ b/packages/amplify-category-storage/resources/overrides-resource/S3/override.ts
@@ -0,0 +1,6 @@
+/* Add Amplify Helper dependencies     */
+
+/* TODO: Need to change props to Root-Stack specific props when props are ready */
+export function overrideProps(props: any): void {
+  /* TODO: Add snippet of how to override in comments */
+}
diff --git a/packages/amplify-category-storage/resources/overrides-resource/S3/package.json b/packages/amplify-category-storage/resources/overrides-resource/S3/package.json
new file mode 100644
index 00000000000..1601dccfc02
--- /dev/null
+++ b/packages/amplify-category-storage/resources/overrides-resource/S3/package.json
@@ -0,0 +1,18 @@
+{
+    "name": "overrides-for-root-stack",
+    "version": "1.0.0",
+    "description": "",
+    "scripts": {
+      "build": "tsc",
+      "watch": "tsc -w",
+      "test": "echo \"Error: no test specified\" && exit 1"
+    },
+    "dependencies": {
+      "@types/fs-extra": "^9.0.11",
+      "fs-extra": "^9.1.0"
+    },
+    "devDependencies": {
+      "typescript": "^4.2.4"
+    }
+  }
+  
\ No newline at end of file
diff --git a/packages/amplify-category-storage/resources/overrides-resource/S3/tsconfig.json b/packages/amplify-category-storage/resources/overrides-resource/S3/tsconfig.json
new file mode 100644
index 00000000000..f48614cbf6b
--- /dev/null
+++ b/packages/amplify-category-storage/resources/overrides-resource/S3/tsconfig.json
@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "es6",
+    "module": "commonjs",
+    "strict": false, 
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "outDir": "build"
+  }
+}
+  
\ No newline at end of file
diff --git a/packages/amplify-category-storage/resources/overrides-resource/S3/tsconfig.resource.json b/packages/amplify-category-storage/resources/overrides-resource/S3/tsconfig.resource.json
new file mode 100644
index 00000000000..6504da80283
--- /dev/null
+++ b/packages/amplify-category-storage/resources/overrides-resource/S3/tsconfig.resource.json
@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "es6",
+    "module": "commonjs",
+    "strict": false,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "outDir": "./",
+    "rootDir": "../"
+  },
+  "include": ["../**/*"]
+}
diff --git a/packages/amplify-category-storage/resources/schemas/DynamoDB/DynamoDBCLIInputs.schema.json b/packages/amplify-category-storage/resources/schemas/DynamoDB/DynamoDBCLIInputs.schema.json
new file mode 100644
index 00000000000..1143f79c937
--- /dev/null
+++ b/packages/amplify-category-storage/resources/schemas/DynamoDB/DynamoDBCLIInputs.schema.json
@@ -0,0 +1,64 @@
+{
+  "type": "object",
+  "properties": {
+    "resourceName": {
+      "type": "string"
+    },
+    "tableName": {
+      "type": "string"
+    },
+    "partitionKey": {
+      "$ref": "#/definitions/DynamoDBCLIInputsKeyType"
+    },
+    "sortKey": {
+      "$ref": "#/definitions/DynamoDBCLIInputsKeyType"
+    },
+    "gsi": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/DynamoDBCLIInputsGSIType"
+      }
+    },
+    "triggerFunctions": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    }
+  },
+  "required": ["partitionKey", "resourceName", "tableName"],
+  "definitions": {
+    "DynamoDBCLIInputsKeyType": {
+      "type": "object",
+      "properties": {
+        "fieldName": {
+          "type": "string"
+        },
+        "fieldType": {
+          "$ref": "#/definitions/FieldType"
+        }
+      },
+      "required": ["fieldName", "fieldType"]
+    },
+    "FieldType": {
+      "enum": ["binary", "boolean", "list", "map", "null", "number", "string"],
+      "type": "string"
+    },
+    "DynamoDBCLIInputsGSIType": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "partitionKey": {
+          "$ref": "#/definitions/DynamoDBCLIInputsKeyType"
+        },
+        "sortKey": {
+          "$ref": "#/definitions/DynamoDBCLIInputsKeyType"
+        }
+      },
+      "required": ["name", "partitionKey"]
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}
diff --git a/packages/amplify-category-storage/resources/schemas/S3/S3UserInputs.schema.json b/packages/amplify-category-storage/resources/schemas/S3/S3UserInputs.schema.json
new file mode 100644
index 00000000000..0254f73d206
--- /dev/null
+++ b/packages/amplify-category-storage/resources/schemas/S3/S3UserInputs.schema.json
@@ -0,0 +1,50 @@
+{
+  "type": "object",
+  "properties": {
+    "resourceName": {
+      "type": "string"
+    },
+    "bucketName": {
+      "type": "string"
+    },
+    "storageAccess": {
+      "$ref": "#/definitions/S3AccessType"
+    },
+    "selectedGuestPermissions": {
+      "type": "array",
+      "items": {
+        "enum": ["DELETE_OBJECT", "GET_OBJECT", "LIST_BUCKET", "PUT_OBJECT"],
+        "type": "string"
+      }
+    },
+    "selectedAuthenticatedPermissions": {
+      "type": "array",
+      "items": {
+        "enum": ["DELETE_OBJECT", "GET_OBJECT", "LIST_BUCKET", "PUT_OBJECT"],
+        "type": "string"
+      }
+    },
+    "isTriggerEnabled": {
+      "type": "boolean"
+    },
+    "triggerFunctionName": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "bucketName",
+    "isTriggerEnabled",
+    "resourceName",
+    "selectedAuthenticatedPermissions",
+    "selectedGuestPermissions",
+    "storageAccess",
+    "triggerFunctionName"
+  ],
+  "definitions": {
+    "S3AccessType": {
+      "enum": ["auth", "authAndGuest"],
+      "type": "string"
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}
diff --git a/packages/amplify-category-storage/src/commands/storage/override.ts b/packages/amplify-category-storage/src/commands/storage/override.ts
new file mode 100644
index 00000000000..4b56910d6a1
--- /dev/null
+++ b/packages/amplify-category-storage/src/commands/storage/override.ts
@@ -0,0 +1,83 @@
+/*
+    entry code for amplify override root
+*/
+
+import { generateOverrideSkeleton, $TSContext, FeatureFlags, stateManager, pathManager } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
+import * as fs from 'fs-extra';
+import inquirer from 'inquirer';
+import { DynamoDBInputState } from '../../provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state';
+import { DDBStackTransform } from '../../provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform';
+import * as path from 'path';
+import { categoryName } from '../../constants';
+
+export const name = 'override';
+
+export const run = async (context: $TSContext) => {
+  if (FeatureFlags.getBoolean('overrides.project')) {
+    const { amplify } = context;
+    const amplifyMeta = stateManager.getMeta();
+
+    const storageResources: string[] = [];
+
+    Object.keys(amplifyMeta[categoryName]).forEach(resourceName => {
+      storageResources.push(resourceName);
+    });
+
+    if (storageResources.length === 0) {
+      const errMessage = 'No resources to override. You need to add a resource.';
+      printer.error(errMessage);
+      return;
+    }
+
+    let selectedResourceName: string = storageResources[0];
+
+    if (storageResources.length > 1) {
+      const resourceAnswer = await inquirer.prompt({
+        type: 'list',
+        name: 'resource',
+        message: 'Which resource would you like to add overrides for?',
+        choices: storageResources,
+      });
+      selectedResourceName = resourceAnswer.resource;
+    }
+
+    const destPath = pathManager.getResourceDirectoryPath(undefined, categoryName, selectedResourceName);
+    fs.ensureDirSync(destPath);
+
+    const srcPath = path.join(
+      __dirname,
+      '..',
+      '..',
+      '..',
+      'resources',
+      'overrides-resource',
+      amplifyMeta[categoryName][selectedResourceName].service,
+    );
+
+    // Make sure to migrate first
+    if (amplifyMeta[categoryName][selectedResourceName].service === 'DynamoDB') {
+      const resourceInputState = new DynamoDBInputState(selectedResourceName);
+      if (!resourceInputState.cliInputFileExists()) {
+        if (await amplify.confirmPrompt('File migration required to continue. Do you want to continue?', true)) {
+          resourceInputState.migrate();
+          const stackGenerator = new DDBStackTransform(selectedResourceName);
+          stackGenerator.transform();
+        } else {
+          return;
+        }
+      }
+    } else if (amplifyMeta[categoryName][selectedResourceName].service === 'S3') {
+      // S3 migration logic goes in here
+    }
+
+    await generateOverrideSkeleton(context, srcPath, destPath);
+  } else {
+    printer.info('Storage overrides is currently not turned on. In amplify/cli.json file please include the following:');
+    printer.info(`{
+      override: {
+         storage: true
+      }
+    }`);
+  }
+};
diff --git a/packages/amplify-category-storage/src/index.ts b/packages/amplify-category-storage/src/index.ts
index 5b4d07b74bb..4eca6161280 100644
--- a/packages/amplify-category-storage/src/index.ts
+++ b/packages/amplify-category-storage/src/index.ts
@@ -1,76 +1,103 @@
-import { $TSAny, $TSContext, $TSObject, stateManager } from 'amplify-cli-core';
-import { printer } from 'amplify-prompts';
 import * as path from 'path';
 import sequential from 'promise-sequential';
+import { printer } from 'amplify-prompts';
 import { updateConfigOnEnvInit } from './provider-utils/awscloudformation';
-import { categoryName } from './constants';
-export { categoryName as category } from './constants';
+import { $TSContext, AmplifyCategories, IAmplifyResource, pathManager } from 'amplify-cli-core';
+import { DDBStackTransform } from './provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform';
+import { DynamoDBInputState } from './provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state';
+export { AmplifyDDBResourceTemplate } from './provider-utils/awscloudformation/cdk-stack-builder/types';
 
-export async function add(context: $TSContext, providerName: string, service: string) {
+async function add(context: any, providerName: any, service: any) {
   const options = {
     service,
     providerPlugin: providerName,
   };
 
-  const providerController = await import(`./provider-utils/${providerName}`);
+  const providerController = require(`./provider-utils/${providerName}`);
 
   if (!providerController) {
     printer.error('Provider not configured for this category');
     return;
   }
 
-  return providerController.addResource(context, categoryName, service, options);
+  return providerController.addResource(context, AmplifyCategories.STORAGE, service, options);
 }
 
-export async function console(context: $TSContext) {
-  printer.info(`to be implemented: ${categoryName} console`);
+async function categoryConsole(context: any) {
+  printer.info(`to be implemented: ${AmplifyCategories.STORAGE} console`);
 }
 
-export async function migrate(context: $TSContext) {
+async function migrateStorageCategory(context: any) {
   const { projectPath, amplifyMeta } = context.migrationInfo;
-  const migrateResourcePromises: Promise<$TSAny>[] = [];
-
-  const categoryResources = amplifyMeta?.[categoryName] || {};
+  const migrateResourcePromises: any = [];
+
+  Object.keys(amplifyMeta).forEach(categoryName => {
+    if (categoryName === AmplifyCategories.STORAGE) {
+      Object.keys(amplifyMeta[AmplifyCategories.STORAGE]).forEach(resourceName => {
+        try {
+          const providerController = require(`./provider-utils/${amplifyMeta[AmplifyCategories.STORAGE][resourceName].providerPlugin}`);
+
+          if (providerController) {
+            migrateResourcePromises.push(
+              providerController.migrateResource(
+                context,
+                projectPath,
+                amplifyMeta[AmplifyCategories.STORAGE][resourceName].service,
+                resourceName,
+              ),
+            );
+          } else {
+            printer.error(`Provider not configured for ${AmplifyCategories.STORAGE}: ${resourceName}`);
+          }
+        } catch (e) {
+          printer.warn(`Could not run migration for ${AmplifyCategories.STORAGE}: ${resourceName}`);
+          throw e;
+        }
+      });
+    }
+  });
 
-  for (const resourceName of Object.keys(categoryResources)) {
-    try {
-      const providerController = await import(`./provider-utils/${amplifyMeta[categoryName][resourceName].providerPlugin}`);
+  await Promise.all(migrateResourcePromises);
+}
 
-      if (providerController) {
-        migrateResourcePromises.push(
-          await providerController.migrateResource(context, projectPath, amplifyMeta[categoryName][resourceName].service, resourceName),
-        );
-      } else {
-        printer.error(`Provider not configured for ${categoryName}: ${resourceName}`);
-      }
-    } catch (e) {
-      printer.warn(`Could not run migration for ${categoryName}: ${resourceName}`);
-      throw e;
+async function transformCategoryStack(context: $TSContext, resource: IAmplifyResource) {
+  if (resource.service === 'DynamoDB') {
+    if (canResourceBeTransformed(resource.resourceName)) {
+      const stackGenerator = new DDBStackTransform(resource.resourceName);
+      stackGenerator.transform();
     }
+  } else if (resource.service === 'S3') {
+    // Not yet implemented
   }
+}
 
-  await Promise.all(migrateResourcePromises);
+function canResourceBeTransformed(resourceName: string) {
+  const resourceInputState = new DynamoDBInputState(resourceName);
+  return resourceInputState.cliInputFileExists();
 }
 
-export async function getPermissionPolicies(context: $TSContext, resourceOpsMapping: $TSAny) {
-  const amplifyMeta = stateManager.getMeta();
-  const permissionPolicies: $TSAny[] = [];
-  const resourceAttributes: $TSAny[] = [];
+async function getPermissionPolicies(context: any, resourceOpsMapping: any) {
+  const amplifyMetaFilePath = context.amplify.pathManager.getAmplifyMetaFilePath();
+  const amplifyMeta = context.amplify.readJsonFile(amplifyMetaFilePath);
+  const permissionPolicies: any = [];
+  const resourceAttributes: any = [];
+  const storageCategory = AmplifyCategories.STORAGE;
 
-  for (const resourceName of Object.keys(resourceOpsMapping)) {
+  Object.keys(resourceOpsMapping).forEach(resourceName => {
     try {
       const providerPlugin =
         'providerPlugin' in resourceOpsMapping[resourceName]
           ? resourceOpsMapping[resourceName].providerPlugin
-          : amplifyMeta[categoryName][resourceName].providerPlugin;
+          : amplifyMeta[storageCategory][resourceName].providerPlugin;
       const service =
         'service' in resourceOpsMapping[resourceName]
           ? resourceOpsMapping[resourceName].service
-          : amplifyMeta[categoryName][resourceName].service;
+          : amplifyMeta[storageCategory][resourceName].service;
 
       if (providerPlugin) {
-        const providerController = await import(`./provider-utils/${providerPlugin}`);
-        const { policy, attributes } = await providerController.getPermissionPolicies(
+        const providerController = require(`./provider-utils/${providerPlugin}`);
+        const { policy, attributes } = providerController.getPermissionPolicies(
+          context,
           service,
           resourceName,
           resourceOpsMapping[resourceName],
@@ -80,54 +107,54 @@ export async function getPermissionPolicies(context: $TSContext, resourceOpsMapp
         } else {
           permissionPolicies.push(policy);
         }
-        resourceAttributes.push({ resourceName, attributes, category: categoryName });
+        resourceAttributes.push({ resourceName, attributes, storageCategory });
       } else {
-        printer.error(`Provider not configured for ${categoryName}: ${resourceName}`);
+        printer.error(`Provider not configured for ${storageCategory}: ${resourceName}`);
       }
     } catch (e) {
-      printer.warn(`Could not get policies for ${categoryName}: ${resourceName}`);
+      printer.warn(`Could not get policies for ${storageCategory}: ${resourceName}`);
       throw e;
     }
-  }
+  });
 
   return { permissionPolicies, resourceAttributes };
 }
 
-export async function executeAmplifyCommand(context: $TSContext) {
+async function executeAmplifyCommand(context: any) {
   let commandPath = path.normalize(path.join(__dirname, 'commands'));
 
   if (context.input.command === 'help') {
-    commandPath = path.join(commandPath, categoryName);
+    commandPath = path.join(commandPath, AmplifyCategories.STORAGE);
   } else {
-    commandPath = path.join(commandPath, categoryName, context.input.command);
+    commandPath = path.join(commandPath, AmplifyCategories.STORAGE, context.input.command);
   }
 
-  const commandModule = await import(commandPath);
+  const commandModule = require(commandPath);
 
   await commandModule.run(context);
 }
 
-export async function handleAmplifyEvent(context: $TSContext, args: $TSAny) {
-  printer.info(`${categoryName} handleAmplifyEvent to be implemented`);
+async function handleAmplifyEvent(context: any, args: any) {
+  printer.info(`${AmplifyCategories.STORAGE} handleAmplifyEvent to be implemented`);
   printer.info(`Received event args ${args}`);
 }
 
-export async function initEnv(context: $TSContext) {
-  const { resourcesToBeSynced, allResources } = await context.amplify.getResourceStatus(categoryName);
+async function initEnv(context: any) {
+  const { resourcesToBeSynced, allResources } = await context.amplify.getResourceStatus(AmplifyCategories.STORAGE);
   const isPulling = context.input.command === 'pull' || (context.input.command === 'env' && context.input.subCommands[0] === 'pull');
-  let toBeSynced: $TSObject[] = [];
+  let toBeSynced = [];
 
   if (resourcesToBeSynced && resourcesToBeSynced.length > 0) {
-    toBeSynced = resourcesToBeSynced.filter((b: $TSObject) => b.category === categoryName);
+    toBeSynced = resourcesToBeSynced.filter((b: any) => b.category === AmplifyCategories.STORAGE);
   }
 
   toBeSynced
-    .filter(storageResource => storageResource.sync === 'unlink')
-    .forEach(storageResource => {
-      context.amplify.removeResourceParameters(context, categoryName, storageResource.resourceName);
+    .filter((storageResource: any) => storageResource.sync === 'unlink')
+    .forEach((storageResource: any) => {
+      context.amplify.removeResourceParameters(context, AmplifyCategories.STORAGE, storageResource.resourceName);
     });
 
-  let tasks: $TSAny[] = [];
+  let tasks: Record<string, any>[] = [];
 
   // For pull change detection for import sees a difference, to avoid duplicate tasks we don't
   // add the syncable resources, as allResources covers it, otherwise it is required for env add
@@ -145,11 +172,22 @@ export async function initEnv(context: $TSContext) {
     const { resourceName, service } = storageResource;
 
     return async () => {
-      const config = await updateConfigOnEnvInit(context, categoryName, resourceName, service);
-
-      context.amplify.saveEnvResourceParameters(context, categoryName, resourceName, config);
+      const config = await updateConfigOnEnvInit(context, AmplifyCategories.STORAGE, resourceName, service);
+      context.amplify.saveEnvResourceParameters(context, AmplifyCategories.STORAGE, resourceName, config);
     };
   });
 
   await sequential(storageTasks);
 }
+
+module.exports = {
+  add,
+  console: categoryConsole,
+  initEnv,
+  migrate: migrateStorageCategory,
+  getPermissionPolicies,
+  executeAmplifyCommand,
+  handleAmplifyEvent,
+  transformCategoryStack,
+  category: AmplifyCategories.STORAGE,
+};
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-builder.ts b/packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-builder.ts
new file mode 100644
index 00000000000..44dad1f403a
--- /dev/null
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-builder.ts
@@ -0,0 +1,188 @@
+import * as cdk from '@aws-cdk/core';
+import * as ddb from '@aws-cdk/aws-dynamodb';
+import { DynamoDBCLIInputs, DynamoDBCLIInputsKeyType, FieldType } from '../service-walkthrough-types/dynamoDB-user-input-types';
+import { AmplifyDDBResourceTemplate } from './types';
+
+const CFN_TEMPLATE_FORMAT_VERSION = '2010-09-09';
+const ROOT_CFN_DESCRIPTION = 'DDB Resource for AWS Amplify CLI';
+
+export class AmplifyDDBResourceStack extends cdk.Stack implements AmplifyDDBResourceTemplate {
+  _scope: cdk.Construct;
+  dynamoDBTable!: ddb.CfnTable;
+  _props: DynamoDBCLIInputs;
+  _cfnParameterMap: Map<string, cdk.CfnParameter> = new Map();
+
+  constructor(scope: cdk.Construct, id: string, props: DynamoDBCLIInputs) {
+    super(scope, id, undefined);
+    this._scope = scope;
+    this._props = props;
+    this.templateOptions.templateFormatVersion = CFN_TEMPLATE_FORMAT_VERSION;
+    this.templateOptions.description = ROOT_CFN_DESCRIPTION;
+  }
+
+  /**
+   *
+   * @param props :cdk.CfnOutputProps
+   * @param logicalId: : lodicalId of the Resource
+   */
+  addCfnOutput(props: cdk.CfnOutputProps, logicalId: string): void {
+    try {
+      new cdk.CfnOutput(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnMapping(props: cdk.CfnMappingProps, logicalId: string): void {
+    try {
+      new cdk.CfnMapping(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnCondition(props: cdk.CfnConditionProps, logicalId: string): void {
+    try {
+      new cdk.CfnCondition(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnResource(props: cdk.CfnResourceProps, logicalId: string): void {
+    try {
+      new cdk.CfnResource(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnParameter(props: cdk.CfnParameterProps, logicalId: string): void {
+    try {
+      if (this._cfnParameterMap.has(logicalId)) {
+        throw new Error('logical Id already Exists');
+      }
+      this._cfnParameterMap.set(logicalId, new cdk.CfnParameter(this, logicalId, props));
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  generateStackResources = async () => {
+    let usedAttributes: DynamoDBCLIInputsKeyType[] = [];
+    let keySchema: ddb.CfnTable.KeySchemaProperty[] = [];
+    let globalSecondaryIndexes: ddb.CfnTable.GlobalSecondaryIndexProperty[] = [];
+
+    if (this._props.partitionKey) {
+      usedAttributes.push(this._props.partitionKey);
+      keySchema.push({
+        attributeName: this._props.partitionKey.fieldName,
+        keyType: 'HASH',
+      });
+    }
+    if (this._props.sortKey) {
+      usedAttributes.push(this._props.sortKey);
+      keySchema.push({
+        attributeName: this._props.sortKey.fieldName,
+        keyType: 'RANGE',
+      });
+    }
+    if (this._props.gsi && this._props.gsi.length > 0) {
+      this._props.gsi.forEach(gsi => {
+        let gsiIndex = {
+          indexName: gsi.name,
+          keySchema: [
+            {
+              attributeName: gsi.partitionKey.fieldName,
+              keyType: 'HASH',
+            },
+          ],
+          projection: {
+            projectionType: 'ALL',
+          },
+          provisionedThroughput: {
+            readCapacityUnits: 5,
+            writeCapacityUnits: 5,
+          },
+        };
+
+        if (usedAttributes.findIndex(attr => attr.fieldName === gsi.partitionKey.fieldName) === -1) {
+          usedAttributes.push(gsi.partitionKey);
+        }
+        if (gsi.sortKey) {
+          gsiIndex.keySchema.push({
+            attributeName: gsi.sortKey?.fieldName,
+            keyType: 'RANGE',
+          });
+          if (usedAttributes.findIndex(attr => attr?.fieldName === gsi.sortKey?.fieldName) == -1) {
+            usedAttributes.push(gsi.sortKey);
+          }
+        }
+        globalSecondaryIndexes.push(gsiIndex);
+      });
+    }
+
+    const ddbAttrTypeMapping = {
+      string: 'S',
+      number: 'N',
+      binary: 'B',
+      boolean: 'BOOL',
+      list: 'L',
+      map: 'M',
+      null: 'NULL',
+      'string-set': 'SS',
+      'number-set': 'NS',
+      'binary-set': 'BS',
+    };
+
+    let attributeMapping: ddb.CfnTable.AttributeDefinitionProperty[] = [];
+
+    usedAttributes.forEach((attr: DynamoDBCLIInputsKeyType) => {
+      attributeMapping.push({
+        attributeName: attr.fieldName,
+        attributeType: ddbAttrTypeMapping[attr.fieldType],
+      });
+    });
+
+    this.dynamoDBTable = new ddb.CfnTable(this, 'DynamoDBTable', {
+      tableName: cdk.Fn.conditionIf(
+        'ShouldNotCreateEnvResources',
+        cdk.Fn.ref('tableName'),
+        cdk.Fn.join('', [cdk.Fn.ref('tableName'), '-', cdk.Fn.ref('env')]),
+      ).toString(),
+      attributeDefinitions: attributeMapping,
+      keySchema,
+      globalSecondaryIndexes,
+      provisionedThroughput: {
+        readCapacityUnits: 5,
+        writeCapacityUnits: 5,
+      },
+      streamSpecification: {
+        streamViewType: 'NEW_IMAGE',
+      },
+    });
+  };
+
+  public renderCloudFormationTemplate = (): string => {
+    return JSON.stringify(this._toCloudFormation(), undefined, 2);
+  };
+}
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform.ts b/packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform.ts
new file mode 100644
index 00000000000..4342016172b
--- /dev/null
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform.ts
@@ -0,0 +1,225 @@
+import { DynamoDBCLIInputs } from '../service-walkthrough-types/dynamoDB-user-input-types';
+import { DynamoDBInputState } from '../service-walkthroughs/dynamoDB-input-state';
+import { AmplifyDDBResourceStack } from './ddb-stack-builder';
+import { AmplifyDDBResourceInputParameters, AmplifyDDBResourceTemplate } from './types';
+import { App } from '@aws-cdk/core';
+import * as cdk from '@aws-cdk/core';
+import * as fs from 'fs-extra';
+import { JSONUtilities, pathManager, buildOverrideDir, $TSAny } from 'amplify-cli-core';
+import * as path from 'path';
+import { formatter, printer } from 'amplify-prompts';
+
+export class DDBStackTransform {
+  app: App;
+  _cliInputs: DynamoDBCLIInputs;
+  _resourceTemplateObj: AmplifyDDBResourceStack | undefined;
+  _cliInputsState: DynamoDBInputState;
+  _cfn!: string;
+  _cfnInputParams!: AmplifyDDBResourceInputParameters;
+  _resourceName: string;
+
+  constructor(resourceName: string) {
+    this.app = new App();
+    this._resourceName = resourceName;
+
+    // Validate the cli-inputs.json for the resource
+    this._cliInputsState = new DynamoDBInputState(resourceName);
+    this._cliInputs = this._cliInputsState.getCliInputPayload();
+    this._cliInputsState.isCLIInputsValid();
+  }
+
+  async transform() {
+    // Generate  cloudformation stack from cli-inputs.json
+    await this.generateStack();
+
+    // Generate  cloudformation stack input params from cli-inputs.json
+    this.generateCfnInputParameters();
+
+    // Modify cloudformation files based on overrides
+    await this.applyOverrides();
+
+    // Save generated cloudformation.json and parameters.json files
+    this.saveBuildFiles();
+  }
+
+  generateCfnInputParameters() {
+    this._cfnInputParams = {
+      tableName: this._cliInputs.tableName,
+      partitionKeyName: this._cliInputs.partitionKey.fieldName,
+      partitionKeyType: this._cliInputs.partitionKey.fieldType,
+    };
+    if (this._cliInputs.sortKey) {
+      this._cfnInputParams.sortKeyName = this._cliInputs.sortKey.fieldName;
+      this._cfnInputParams.sortKeyType = this._cliInputs.sortKey.fieldType;
+    }
+  }
+
+  async generateStack() {
+    this._resourceTemplateObj = new AmplifyDDBResourceStack(this.app, 'AmplifyDDBResourceStack', this._cliInputs);
+
+    // Add Parameters
+    this._resourceTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+      },
+      'partitionKeyName',
+    );
+    this._resourceTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+      },
+      'partitionKeyType',
+    );
+    this._resourceTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+      },
+      'env',
+    );
+    if (this._cliInputs.sortKey) {
+      this._resourceTemplateObj.addCfnParameter(
+        {
+          type: 'String',
+        },
+        'sortKeyName',
+      );
+
+      this._resourceTemplateObj.addCfnParameter(
+        {
+          type: 'String',
+        },
+        'sortKeyType',
+      );
+    }
+    this._resourceTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+      },
+      'tableName',
+    );
+
+    // Add conditions
+
+    this._resourceTemplateObj.addCfnCondition(
+      {
+        expression: cdk.Fn.conditionEquals(cdk.Fn.ref('env'), 'NONE'),
+      },
+      'ShouldNotCreateEnvResources',
+    );
+
+    // Add resources
+
+    await this._resourceTemplateObj.generateStackResources();
+
+    // Add outputs
+    this._resourceTemplateObj.addCfnOutput(
+      {
+        value: cdk.Fn.ref('DynamoDBTable'),
+      },
+      'Name',
+    );
+    this._resourceTemplateObj.addCfnOutput(
+      {
+        value: cdk.Fn.getAtt('DynamoDBTable', 'Arn').toString(),
+      },
+      'Arn',
+    );
+    this._resourceTemplateObj.addCfnOutput(
+      {
+        value: cdk.Fn.getAtt('DynamoDBTable', 'StreamArn').toString(),
+      },
+      'StreamArn',
+    );
+    this._resourceTemplateObj.addCfnOutput(
+      {
+        value: cdk.Fn.ref('partitionKeyName'),
+      },
+      'PartitionKeyName',
+    );
+    this._resourceTemplateObj.addCfnOutput(
+      {
+        value: cdk.Fn.ref('partitionKeyType'),
+      },
+      'PartitionKeyType',
+    );
+
+    if (this._cliInputs.sortKey) {
+      this._resourceTemplateObj.addCfnOutput(
+        {
+          value: cdk.Fn.ref('sortKeyName'),
+        },
+        'SortKeyName',
+      );
+      this._resourceTemplateObj.addCfnOutput(
+        {
+          value: cdk.Fn.ref('sortKeyType'),
+        },
+        'SortKeyType',
+      );
+    }
+
+    this._resourceTemplateObj.addCfnOutput(
+      {
+        value: cdk.Fn.ref('AWS::Region'),
+      },
+      'Region',
+    );
+  }
+
+  async applyOverrides() {
+    const backendDir = pathManager.getBackendDirPath();
+    const overrideFilePath = pathManager.getResourceDirectoryPath(undefined, 'storage', this._resourceName);
+
+    const isBuild = await buildOverrideDir(backendDir, overrideFilePath).catch(error => {
+      printer.warn(`Skipping build as ${error.message}`);
+      return false;
+    });
+    // skip if packageManager or override.ts not found
+    if (isBuild) {
+      const { overrideProps } = await import(path.join(overrideFilePath, 'build', 'override.js')).catch(error => {
+        formatter.list(['No override File Found', `To override ${this._resourceName} run amplify override auth ${this._resourceName} `]);
+        return undefined;
+      });
+
+      // pass stack object
+      const ddbStackTemplateObj = this._resourceTemplateObj as AmplifyDDBResourceTemplate;
+      //TODO: Check Script Options
+      if (typeof overrideProps === 'function' && overrideProps) {
+        try {
+          this._resourceTemplateObj = overrideProps(this._resourceTemplateObj as AmplifyDDBResourceTemplate);
+
+          //The vm module enables compiling and running code within V8 Virtual Machine contexts. The vm module is not a security mechanism. Do not use it to run untrusted code.
+          // const script = new vm.Script(overrideCode);
+          // script.runInContext(vm.createContext(cognitoStackTemplateObj));
+          return;
+        } catch (error: $TSAny) {
+          throw new Error(error);
+        }
+      }
+    }
+  }
+
+  saveBuildFiles() {
+    if (this._resourceTemplateObj) {
+      this._cfn = JSON.parse(this._resourceTemplateObj.renderCloudFormationTemplate());
+    }
+
+    // store files in local-filesysten
+
+    fs.ensureDirSync(this._cliInputsState.buildFilePath);
+    const cfnFilePath = path.resolve(path.join(this._cliInputsState.buildFilePath, 'cloudformation-template.json'));
+    try {
+      JSONUtilities.writeJson(cfnFilePath, this._cfn);
+    } catch (e) {
+      throw new Error(e);
+    }
+
+    fs.ensureDirSync(this._cliInputsState.buildFilePath);
+    const cfnInputParamsFilePath = path.resolve(path.join(this._cliInputsState.buildFilePath, 'parameters.json'));
+    try {
+      JSONUtilities.writeJson(cfnInputParamsFilePath, this._cfnInputParams);
+    } catch (e) {
+      throw new Error(e);
+    }
+  }
+}
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/s3-stack-builder.ts b/packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/s3-stack-builder.ts
new file mode 100644
index 00000000000..3681e1a45e1
--- /dev/null
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/s3-stack-builder.ts
@@ -0,0 +1,5 @@
+// import * as cdk from '@aws-cdk/core';
+// import * as s3 from '@aws-cdk/aws-s3';
+// import * as iam from '@aws-cdk/aws-iam';
+// import { AmplifyRootStackTemplate } from '';
+// import { IStackSynthesizer, ISynthesisSession } from '@aws-cdk/core';
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/types.ts b/packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/types.ts
new file mode 100644
index 00000000000..9aa24d95549
--- /dev/null
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/cdk-stack-builder/types.ts
@@ -0,0 +1,20 @@
+import * as cdk from '@aws-cdk/core';
+import * as ddb from '@aws-cdk/aws-dynamodb';
+
+export interface AmplifyDDBResourceTemplate {
+  dynamoDBTable?: ddb.CfnTable;
+
+  addCfnParameter(props: cdk.CfnParameterProps, logicalId: string): void;
+  addCfnOutput(props: cdk.CfnOutputProps, logicalId: string): void;
+  addCfnMapping(props: cdk.CfnMappingProps, logicalId: string): void;
+  addCfnCondition(props: cdk.CfnConditionProps, logicalId: string): void;
+  addCfnResource(props: cdk.CfnResourceProps, logicalId: string): void;
+}
+
+export interface AmplifyDDBResourceInputParameters {
+  tableName: string;
+  partitionKeyName: string;
+  partitionKeyType: string;
+  sortKeyName?: string;
+  sortKeyType?: string;
+}
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/cfn-template-utils.ts b/packages/amplify-category-storage/src/provider-utils/awscloudformation/cfn-template-utils.ts
index ae869e23d56..4ac56de2658 100644
--- a/packages/amplify-category-storage/src/provider-utils/awscloudformation/cfn-template-utils.ts
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/cfn-template-utils.ts
@@ -3,10 +3,15 @@ import { Template } from 'cloudform-types';
 import Table, { AttributeDefinition, GlobalSecondaryIndex } from 'cloudform-types/types/dynamoDb/table';
 import _ from 'lodash';
 import * as path from 'path';
-const category = 'storage';
+import { AmplifyCategories } from 'amplify-cli-core';
 
 export const getCloudFormationTemplatePath = (resourceName: string) => {
-  return path.join(pathManager.getBackendDirPath(), category, resourceName, `${resourceName}-cloudformation-template.json`);
+  return path.join(
+    pathManager.getBackendDirPath(),
+    AmplifyCategories.STORAGE,
+    resourceName,
+    `${resourceName}-cloudformation-template.json`,
+  );
 };
 
 export const getExistingStorageGSIs = async (resourceName: string) => {
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/dynamoDb-defaults.js b/packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/dynamoDb-defaults.ts
similarity index 80%
rename from packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/dynamoDb-defaults.js
rename to packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/dynamoDb-defaults.ts
index fb1983ef6e1..b082c39b563 100644
--- a/packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/dynamoDb-defaults.js
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/dynamoDb-defaults.ts
@@ -1,6 +1,6 @@
-const uuid = require('uuid');
+import uuid from 'uuid';
 
-const getAllDefaults = project => {
+const getAllDefaults = (project: any) => {
   const name = project.projectConfig.projectName.toLowerCase();
   const [shortId] = uuid().split('-');
   const defaults = {
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/s3-defaults.js b/packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/s3-defaults.ts
similarity index 91%
rename from packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/s3-defaults.js
rename to packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/s3-defaults.ts
index 5d1572b7392..54e75718c25 100644
--- a/packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/s3-defaults.js
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/default-values/s3-defaults.ts
@@ -1,6 +1,6 @@
-const uuid = require('uuid');
+import uuid from 'uuid';
 
-const getAllDefaults = project => {
+const getAllDefaults = (project: any) => {
   const name = project.projectConfig.projectName.toLowerCase();
   const [shortId] = uuid().split('-');
 
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthrough-types/dynamoDB-user-input-types.ts b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthrough-types/dynamoDB-user-input-types.ts
new file mode 100644
index 00000000000..7fcfad7b663
--- /dev/null
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthrough-types/dynamoDB-user-input-types.ts
@@ -0,0 +1,41 @@
+export enum DynamoDBImmutableFields {
+  resourceName = 'resourceName',
+  tableName = 'tableName',
+  partitionKey = 'partitionKey',
+  sortKey = 'sortKey',
+}
+
+export enum FieldType {
+  string = 'string',
+  number = 'number',
+  binary = 'binary',
+  boolean = 'boolean',
+  list = 'list',
+  map = 'map',
+  null = 'null',
+}
+
+export interface DynamoDBAttributeDefType {
+  AttributeName: string;
+  AttributeType: FieldType;
+}
+
+export interface DynamoDBCLIInputsKeyType {
+  fieldName: string;
+  fieldType: FieldType;
+}
+
+export interface DynamoDBCLIInputsGSIType {
+  name: string;
+  partitionKey: DynamoDBCLIInputsKeyType;
+  sortKey?: DynamoDBCLIInputsKeyType;
+}
+
+export interface DynamoDBCLIInputs {
+  resourceName: string;
+  tableName: string;
+  partitionKey: DynamoDBCLIInputsKeyType;
+  sortKey?: DynamoDBCLIInputsKeyType;
+  gsi?: DynamoDBCLIInputsGSIType[];
+  triggerFunctions?: string[];
+}
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthrough-types/s3-user-input-types.ts b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthrough-types/s3-user-input-types.ts
new file mode 100644
index 00000000000..ba6ed3abcd5
--- /dev/null
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthrough-types/s3-user-input-types.ts
@@ -0,0 +1,28 @@
+//user input-data types generated by cli
+
+export function enumToHelp(obj: object) {
+  return `One of ${Object.values(obj)}`;
+}
+
+export enum S3AccessType {
+  AUTH_AND_GUEST = 'authAndGuest',
+  AUTH_ONLY = 'auth',
+}
+
+export enum S3PermissionType {
+  PUT_OBJECT = 'PUT_OBJECT',
+  GET_OBJECT = 'GET_OBJECT',
+  DELETE_OBJECT = 'DELETE_OBJECT',
+  LIST_BUCKET = 'LIST_BUCKET',
+}
+
+//User input data for S3 service
+export interface S3UserInputs {
+  resourceName: string;
+  bucketName: string;
+  storageAccess: S3AccessType;
+  selectedGuestPermissions: S3PermissionType[];
+  selectedAuthenticatedPermissions: S3PermissionType[];
+  isTriggerEnabled: boolean; //enable if trigger
+  triggerFunctionName: string | undefined;
+}
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state.ts b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state.ts
new file mode 100644
index 00000000000..f8b111415fc
--- /dev/null
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state.ts
@@ -0,0 +1,165 @@
+import { DynamoDBCLIInputs, DynamoDBCLIInputsGSIType } from '../service-walkthrough-types/dynamoDB-user-input-types';
+import { AmplifyCategories, AmplifySupportedService, CLIInputSchemaValidator, JSONUtilities, pathManager } from 'amplify-cli-core';
+import * as fs from 'fs-extra';
+import * as path from 'path';
+
+/* Need to move this logic to a base class */
+
+export class DynamoDBInputState {
+  _cliInputsFilePath: string; //cli-inputs.json (output) filepath
+  _resourceName: string; //user friendly name provided by user
+  _category: string; //category of the resource
+  _service: string; //AWS service for the resource
+  buildFilePath: string;
+
+  constructor(resourceName: string) {
+    this._category = AmplifyCategories.STORAGE;
+    this._service = AmplifySupportedService.DYNAMODB;
+    this._resourceName = resourceName;
+
+    const projectBackendDirPath = pathManager.getBackendDirPath();
+    this._cliInputsFilePath = path.resolve(path.join(projectBackendDirPath, AmplifyCategories.STORAGE, resourceName, 'cli-inputs.json'));
+    this.buildFilePath = path.resolve(path.join(projectBackendDirPath, AmplifyCategories.STORAGE, resourceName, 'build'));
+  }
+
+  public getCliInputPayload(): DynamoDBCLIInputs {
+    let cliInputs: DynamoDBCLIInputs;
+
+    // Read cliInputs file if exists
+    try {
+      cliInputs = JSONUtilities.readJson(this._cliInputsFilePath) as DynamoDBCLIInputs;
+    } catch (e) {
+      throw new Error('cli-inputs.json file missing from the resource directory');
+    }
+
+    return cliInputs;
+  }
+
+  public cliInputFileExists(): boolean {
+    return fs.existsSync(this._cliInputsFilePath);
+  }
+
+  public isCLIInputsValid(cliInputs?: DynamoDBCLIInputs) {
+    if (!cliInputs) {
+      cliInputs = this.getCliInputPayload();
+    }
+
+    const schemaValidator = new CLIInputSchemaValidator(this._service, this._category, 'DynamoDBCLIInputs');
+    schemaValidator.validateInput(JSON.stringify(cliInputs));
+  }
+
+  public saveCliInputPayload(cliInputs: DynamoDBCLIInputs): void {
+    this.isCLIInputsValid(cliInputs);
+
+    fs.ensureDirSync(path.join(pathManager.getBackendDirPath(), this._category, this._resourceName));
+    try {
+      JSONUtilities.writeJson(this._cliInputsFilePath, cliInputs);
+    } catch (e) {
+      throw new Error(e);
+    }
+  }
+
+  public migrate() {
+    let cliInputs: DynamoDBCLIInputs;
+    const attrReverseMap: any = {
+      S: 'string',
+      N: 'number',
+      B: 'binary',
+      BOOL: 'boolean',
+      L: 'list',
+      M: 'map',
+      NULL: null,
+      SS: 'string-set',
+      NS: 'number-set',
+      BS: 'binary-set',
+    };
+
+    // migrate the resource to new directory structure if cli-inputs.json is not found for the resource
+
+    const backendDir = pathManager.getBackendDirPath();
+    const oldParametersFilepath = path.join(backendDir, 'storage', this._resourceName, 'parameters.json');
+    const oldCFNFilepath = path.join(backendDir, 'storage', this._resourceName, `${this._resourceName}-cloudformation-template.json`);
+    const oldStorageParamsFilepath = path.join(backendDir, 'storage', this._resourceName, `storage-params.json`);
+
+    const oldParameters: any = JSONUtilities.readJson(oldParametersFilepath, { throwIfNotExist: true });
+    const oldCFN: any = JSONUtilities.readJson(oldCFNFilepath, { throwIfNotExist: true });
+    const oldStorageParams: any = JSONUtilities.readJson(oldStorageParamsFilepath, { throwIfNotExist: false }) || {};
+
+    const partitionKey = {
+      fieldName: oldParameters.partitionKeyName,
+      fieldType: attrReverseMap[oldParameters.partitionKeyType],
+    };
+
+    let sortKey;
+
+    if (oldParameters.sortKeyName) {
+      sortKey = {
+        fieldName: oldParameters.sortKeyName,
+        fieldType: attrReverseMap[oldParameters.sortKeyType],
+      };
+    }
+
+    let triggerFunctions = [];
+
+    if (oldStorageParams.triggerFunctions) {
+      triggerFunctions = oldStorageParams.triggerFunctions;
+    }
+
+    const getType = (attrList: any, attrName: string) => {
+      let attrType;
+
+      attrList.forEach((attr: any) => {
+        if (attr.AttributeName === attrName) {
+          attrType = attrReverseMap[attr.AttributeType];
+        }
+      });
+
+      return attrType;
+    };
+
+    let gsi: DynamoDBCLIInputsGSIType[] = [];
+
+    if (oldCFN?.Resources?.DynamoDBTable?.Properties?.GlobalSecondaryIndexes) {
+      oldCFN.Resources.DynamoDBTable.Properties.GlobalSecondaryIndexes.forEach((cfnGSIValue: any) => {
+        let gsiValue: any = {};
+        (gsiValue.name = cfnGSIValue.IndexName),
+          cfnGSIValue.KeySchema.forEach((keySchema: any) => {
+            if (keySchema.KeyType === 'HASH') {
+              gsiValue.partitionKey = {
+                fieldName: keySchema.AttributeName,
+                fieldType: getType(oldCFN.Resources.DynamoDBTable.Properties.AttributeDefinitions, keySchema.AttributeName),
+              };
+            } else {
+              gsiValue.sortKey = {
+                fieldName: keySchema.AttributeName,
+                fieldType: getType(oldCFN.Resources.DynamoDBTable.Properties.AttributeDefinitions, keySchema.AttributeName),
+              };
+            }
+          });
+        gsi.push(gsiValue);
+      });
+    }
+    cliInputs = {
+      resourceName: this._resourceName,
+      tableName: oldParameters.tableName,
+      partitionKey,
+      sortKey,
+      triggerFunctions,
+      gsi,
+    };
+
+    this.saveCliInputPayload(cliInputs);
+
+    // Remove old files
+
+    if (fs.existsSync(oldCFNFilepath)) {
+      fs.removeSync(oldCFNFilepath);
+    }
+    if (fs.existsSync(oldParametersFilepath)) {
+      fs.removeSync(oldParametersFilepath);
+    }
+    if (fs.existsSync(oldStorageParamsFilepath)) {
+      fs.removeSync(oldStorageParamsFilepath);
+    }
+  }
+}
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.js b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.js
deleted file mode 100644
index 994fe5e4dba..00000000000
--- a/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.js
+++ /dev/null
@@ -1,931 +0,0 @@
-const {
-  getCloudFormationTemplatePath,
-  getExistingStorageAttributeDefinitions,
-  getExistingStorageGSIs,
-  getExistingTableColumnNames,
-} = require('../cfn-template-utils');
-const inquirer = require('inquirer');
-const path = require('path');
-const fs = require('fs-extra');
-const uuid = require('uuid');
-const { ResourceDoesNotExistError, exitOnNextTick } = require('amplify-cli-core');
-const { category } = require('../../..');
-
-// keep in sync with ServiceName in amplify-category-function, but probably it will not change
-const FunctionServiceNameLambdaFunction = 'Lambda';
-
-const parametersFileName = 'parameters.json';
-const storageParamsFileName = 'storage-params.json';
-const serviceName = 'DynamoDB';
-const templateFileName = 'dynamoDb-cloudformation-template.json.ejs';
-
-async function addWalkthrough(context, defaultValuesFilename, serviceMetadata) {
-  return configure(context, defaultValuesFilename, serviceMetadata);
-}
-
-async function updateWalkthrough(context, defaultValuesFilename, serviceMetadata) {
-  // const resourceName = resourceAlreadyExists(context);
-  const { amplify } = context;
-  const { amplifyMeta } = amplify.getProjectDetails();
-
-  const dynamoDbResources = {};
-
-  Object.keys(amplifyMeta[category]).forEach(resourceName => {
-    if (
-      amplifyMeta[category][resourceName].service === serviceName &&
-      amplifyMeta[category][resourceName].mobileHubMigrated !== true &&
-      amplifyMeta[category][resourceName].serviceType !== 'imported'
-    ) {
-      dynamoDbResources[resourceName] = amplifyMeta[category][resourceName];
-    }
-  });
-
-  if (!amplifyMeta[category] || Object.keys(dynamoDbResources).length === 0) {
-    const errMessage = 'No resources to update. You need to add a resource.';
-
-    context.print.error(errMessage);
-    context.usageData.emitError(new ResourceDoesNotExistError(errMessage));
-    exitOnNextTick(0);
-    return;
-  }
-
-  const resources = Object.keys(dynamoDbResources);
-  const question = [
-    {
-      name: 'resourceName',
-      message: 'Specify the resource that you would want to update',
-      type: 'list',
-      choices: resources,
-    },
-  ];
-
-  const answer = await inquirer.prompt(question);
-
-  return await configure(context, defaultValuesFilename, serviceMetadata, answer.resourceName);
-}
-
-async function configure(context, defaultValuesFilename, serviceMetadata, resourceName) {
-  const { amplify, print } = context;
-  const { inputs } = serviceMetadata;
-  const defaultValuesSrc = path.join(__dirname, '..', 'default-values', defaultValuesFilename);
-  const { getAllDefaults } = require(defaultValuesSrc);
-
-  const defaultValues = getAllDefaults(amplify.getProjectDetails());
-  const projectBackendDirPath = context.amplify.pathManager.getBackendDirPath();
-
-  const attributeTypes = {
-    string: { code: 'S', indexable: true },
-    number: { code: 'N', indexable: true },
-    binary: { code: 'B', indexable: true },
-    boolean: { code: 'BOOL', indexable: false },
-    list: { code: 'L', indexable: false },
-    map: { code: 'M', indexable: false },
-    null: { code: 'NULL', indexable: false },
-    'string set': { code: 'SS', indexable: false },
-    'number set': { code: 'NS', indexable: false },
-    'binary set': { code: 'BS', indexable: false },
-  };
-  let usedAttributeDefinitions = new Set();
-  let storageParams = {};
-
-  if (resourceName) {
-    const resourceDirPath = path.join(projectBackendDirPath, category, resourceName);
-    const parametersFilePath = path.join(resourceDirPath, parametersFileName);
-    let parameters;
-
-    try {
-      parameters = context.amplify.readJsonFile(parametersFilePath);
-    } catch (e) {
-      parameters = {};
-    }
-
-    parameters.resourceName = resourceName;
-
-    Object.assign(defaultValues, parameters);
-
-    // Get storage question params
-    const storageParamsFilePath = path.join(resourceDirPath, storageParamsFileName);
-
-    try {
-      storageParams = context.amplify.readJsonFile(storageParamsFilePath);
-    } catch (e) {
-      storageParams = {};
-    }
-  }
-
-  const resourceQuestions = [
-    {
-      type: inputs[0].type,
-      name: inputs[0].key,
-      message: inputs[0].question,
-      validate: amplify.inputValidation(inputs[0]),
-      default: () => {
-        const defaultValue = defaultValues[inputs[0].key];
-        return defaultValue;
-      },
-    },
-    {
-      type: inputs[1].type,
-      name: inputs[1].key,
-      message: inputs[1].question,
-      validate: amplify.inputValidation(inputs[1]),
-      default: answers => {
-        const defaultValue = defaultValues[inputs[1].key];
-        return answers.resourceName || defaultValue;
-      },
-    },
-  ];
-
-  print.info('');
-  print.info('Welcome to the NoSQL DynamoDB database wizard');
-  print.info('This wizard asks you a series of questions to help determine how to set up your NoSQL database table.');
-  print.info('');
-
-  // Ask resource and table name question
-
-  let answers = {};
-
-  if (!resourceName) {
-    answers = await inquirer.prompt(resourceQuestions);
-  }
-
-  print.info('');
-  print.info('You can now add columns to the table.');
-  print.info('');
-
-  // Ask attribute questions
-
-  const attributeQuestion = {
-    type: inputs[2].type,
-    name: inputs[2].key,
-    message: inputs[2].question,
-    validate: amplify.inputValidation(inputs[2]),
-  };
-  const attributeTypeQuestion = {
-    type: inputs[3].type,
-    name: inputs[3].key,
-    message: inputs[3].question,
-    choices: Object.keys(attributeTypes),
-  };
-
-  let continueAttributeQuestion = true;
-  const attributeAnswers = [];
-
-  if (resourceName) {
-    attributeAnswers.push(
-      {
-        AttributeName: defaultValues.partitionKeyName,
-        AttributeType: defaultValues.partitionKeyType,
-      },
-      {
-        AttributeName: defaultValues.sortKeyName,
-        AttributeType: defaultValues.sortKeyType,
-      },
-    );
-
-    continueAttributeQuestion = await amplify.confirmPrompt('Would you like to add another column?');
-  }
-
-  const indexableAttributeList = await getExistingTableColumnNames(resourceName);
-
-  while (continueAttributeQuestion) {
-    const attributeAnswer = await inquirer.prompt([attributeQuestion, attributeTypeQuestion]);
-
-    if (attributeAnswers.findIndex(attribute => attribute.AttributeName === attributeAnswer[inputs[2].key]) !== -1) {
-      continueAttributeQuestion = await amplify.confirmPrompt('This attribute was already added. Do you want to add another attribute?');
-      continue;
-    }
-
-    attributeAnswers.push({
-      AttributeName: attributeAnswer[inputs[2].key],
-      AttributeType: attributeTypes[attributeAnswer[inputs[3].key]].code,
-    });
-
-    if (attributeTypes[attributeAnswer[inputs[3].key]].indexable) {
-      indexableAttributeList.push(attributeAnswer[inputs[2].key]);
-    }
-
-    continueAttributeQuestion = await amplify.confirmPrompt('Would you like to add another column?');
-  }
-
-  answers.AttributeDefinitions = attributeAnswers;
-
-  print.info('');
-  print.info(
-    'Before you create the database, you must specify how items in your table are uniquely organized. You do this by specifying a primary key. The primary key uniquely identifies each item in the table so that no two items can have the same key. This can be an individual column, or a combination that includes a primary key and a sort key.',
-  );
-  print.info('');
-  print.info('To learn more about primary keys, see:');
-  print.info(
-    'https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.CoreComponents.html#HowItWorks.CoreComponents.PrimaryKey',
-  );
-  print.info('');
-  // Ask for primary key
-
-  answers.KeySchema = [];
-  let partitionKeyName;
-  let partitionKeyType;
-
-  if (resourceName) {
-    ({ partitionKeyName } = defaultValues);
-    ({ partitionKeyType } = defaultValues);
-  } else {
-    const primaryKeyQuestion = {
-      type: inputs[4].type,
-      name: inputs[4].key,
-      message: inputs[4].question,
-      validate: amplify.inputValidation(inputs[3]),
-      choices: indexableAttributeList,
-    };
-
-    const partitionKeyAnswer = await inquirer.prompt([primaryKeyQuestion]);
-
-    partitionKeyName = partitionKeyAnswer[inputs[4].key];
-  }
-
-  answers.KeySchema.push({
-    AttributeName: partitionKeyName,
-    KeyType: 'HASH',
-  });
-
-  // Get the type for primary index
-
-  const primaryAttrTypeIndex = answers.AttributeDefinitions.findIndex(attr => attr.AttributeName === partitionKeyName);
-
-  partitionKeyType = answers.AttributeDefinitions[primaryAttrTypeIndex].AttributeType;
-
-  usedAttributeDefinitions.add(partitionKeyName);
-
-  let sortKeyName;
-  let sortKeyType;
-
-  if (resourceName) {
-    ({ sortKeyName } = defaultValues);
-
-    if (sortKeyName) {
-      answers.KeySchema.push({
-        AttributeName: sortKeyName,
-        KeyType: 'RANGE',
-      });
-
-      usedAttributeDefinitions.add(sortKeyName);
-    }
-  } else if (await amplify.confirmPrompt('Do you want to add a sort key to your table?')) {
-    // Ask for sort key
-    if (answers.AttributeDefinitions.length > 1) {
-      const sortKeyQuestion = {
-        type: inputs[5].type,
-        name: inputs[5].key,
-        message: inputs[5].question,
-        choices: indexableAttributeList.filter(att => att !== partitionKeyName),
-      };
-      const sortKeyAnswer = await inquirer.prompt([sortKeyQuestion]);
-
-      sortKeyName = sortKeyAnswer[inputs[5].key];
-
-      answers.KeySchema.push({
-        AttributeName: sortKeyName,
-        KeyType: 'RANGE',
-      });
-
-      usedAttributeDefinitions.add(sortKeyName);
-    } else {
-      context.print.error('You must add additional keys in order to select a sort key.');
-    }
-  }
-
-  if (sortKeyName) {
-    // Get the type for primary index
-    const sortKeyAttrTypeIndex = answers.AttributeDefinitions.findIndex(attr => attr.AttributeName === sortKeyName);
-    sortKeyType = answers.AttributeDefinitions[sortKeyAttrTypeIndex].AttributeType;
-  }
-
-  answers.KeySchema = answers.KeySchema;
-
-  print.info('');
-  print.info(
-    'You can optionally add global secondary indexes for this table. These are useful when you run queries defined in a different column than the primary key.',
-  );
-  print.info('To learn more about indexes, see:');
-  print.info(
-    'https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.CoreComponents.html#HowItWorks.CoreComponents.SecondaryIndexes',
-  );
-  print.info('');
-
-  // Ask for GSI's
-
-  if (await amplify.confirmPrompt('Do you want to add global secondary indexes to your table?')) {
-    let continuewithGSIQuestions = true;
-    const gsiList = [];
-
-    while (continuewithGSIQuestions) {
-      if (indexableAttributeList.length > 0) {
-        const gsiAttributeQuestion = {
-          type: inputs[6].type,
-          name: inputs[6].key,
-          message: inputs[6].question,
-        };
-        const gsiPrimaryKeyQuestion = {
-          type: inputs[7].type,
-          name: inputs[7].key,
-          message: inputs[7].question,
-          validate: amplify.inputValidation(inputs[3]),
-          choices: indexableAttributeList,
-        };
-
-        /*eslint-disable*/
-        const gsiPrimaryAnswer = await inquirer.prompt([gsiAttributeQuestion, gsiPrimaryKeyQuestion]);
-
-        const gsiPrimaryKeyName = gsiPrimaryAnswer[inputs[7].key];
-
-        /* eslint-enable */
-        const gsiItem = {
-          ProvisionedThroughput: {
-            ReadCapacityUnits: '5',
-            WriteCapacityUnits: '5',
-          },
-          Projection: {
-            ProjectionType: 'ALL',
-          },
-          IndexName: gsiPrimaryAnswer[inputs[6].key],
-          KeySchema: [
-            {
-              AttributeName: gsiPrimaryKeyName,
-              KeyType: 'HASH',
-            },
-          ],
-        };
-
-        usedAttributeDefinitions.add(gsiPrimaryKeyName);
-
-        const sortKeyOptions = indexableAttributeList.filter(att => att !== gsiPrimaryKeyName);
-
-        if (sortKeyOptions.length > 0) {
-          if (await amplify.confirmPrompt('Do you want to add a sort key to your global secondary index?')) {
-            const sortKeyQuestion = {
-              type: inputs[8].type,
-              name: inputs[8].key,
-              message: inputs[8].question,
-              choices: sortKeyOptions,
-            };
-
-            const sortKeyAnswer = await inquirer.prompt([sortKeyQuestion]);
-
-            gsiItem.KeySchema.push({
-              AttributeName: sortKeyAnswer[inputs[8].key],
-              KeyType: 'RANGE',
-            });
-
-            usedAttributeDefinitions.add(sortKeyAnswer[inputs[8].key]);
-          }
-        }
-
-        gsiList.push(gsiItem);
-
-        continuewithGSIQuestions = await amplify.confirmPrompt('Do you want to add more global secondary indexes to your table?');
-      } else {
-        context.print.error('You do not have any other attributes remaining to configure');
-        break;
-      }
-    }
-
-    // if resource name is undefined then it's an 'add storage' we want to check on an update
-    if (resourceName) {
-      const existingGSIs = await getExistingStorageGSIs(resourceName);
-      const existingAttributeDefinitions = await getExistingStorageAttributeDefinitions(resourceName);
-      const allAttributeDefinitionsMap = new Map([
-        ...existingAttributeDefinitions.map(r => [r.AttributeName, r]),
-        ...answers.AttributeDefinitions.map(r => [r.AttributeName, r]),
-      ]);
-
-      if (
-        !!existingGSIs.length &&
-        (await amplify.confirmPrompt('Do you want to keep existing global seconday indexes created on your table?'))
-      ) {
-        existingGSIs.forEach(r => gsiList.push(r));
-        answers.AttributeDefinitions = [...allAttributeDefinitionsMap.values()];
-
-        usedAttributeDefinitions = existingGSIs.reduce((prev, current) => {
-          current.KeySchema.map(r => prev.add(r.AttributeName));
-          return prev;
-        }, usedAttributeDefinitions);
-      }
-    }
-
-    if (gsiList.length > 0) {
-      answers.GlobalSecondaryIndexes = gsiList;
-    }
-  }
-
-  usedAttributeDefinitions = Array.from(usedAttributeDefinitions);
-
-  /* Filter out only attribute
-   * definitions which have been used - cfn errors out otherwise */
-  answers.AttributeDefinitions = answers.AttributeDefinitions.filter(
-    attributeDefinition => usedAttributeDefinitions.indexOf(attributeDefinition.AttributeName) !== -1,
-  );
-
-  Object.assign(defaultValues, answers);
-
-  // Ask Lambda trigger question
-  if (!storageParams || !storageParams.triggerFunctions || storageParams.triggerFunctions.length === 0) {
-    if (await amplify.confirmPrompt('Do you want to add a Lambda Trigger for your Table?', false)) {
-      let triggerName;
-
-      try {
-        triggerName = await addTrigger(context, defaultValues.resourceName);
-
-        if (!storageParams) {
-          storageParams = {};
-        }
-
-        storageParams.triggerFunctions = [triggerName];
-      } catch (e) {
-        context.print.error(e.message);
-      }
-    }
-  } else {
-    const triggerOperationQuestion = {
-      type: 'list',
-      name: 'triggerOperation',
-      message: 'Select from the following options',
-      choices: ['Add a Trigger', 'Remove a trigger', 'Skip Question'],
-    };
-    let triggerName;
-    let continueWithTriggerOperationQuestion = true;
-
-    while (continueWithTriggerOperationQuestion) {
-      const triggerOperationAnswer = await inquirer.prompt([triggerOperationQuestion]);
-
-      switch (triggerOperationAnswer.triggerOperation) {
-        case 'Add a Trigger': {
-          try {
-            triggerName = await addTrigger(context, defaultValues.resourceName, storageParams.triggerFunctions);
-            if (!storageParams) {
-              storageParams = {};
-            } else if (!storageParams.triggerFunctions) {
-              storageParams.triggerFunctions = [triggerName];
-            } else {
-              storageParams.triggerFunctions.push(triggerName);
-            }
-
-            continueWithTriggerOperationQuestion = false;
-          } catch (e) {
-            context.print.error(e.message);
-            continueWithTriggerOperationQuestion = true;
-          }
-          break;
-        }
-        case 'Remove a trigger': {
-          try {
-            if (!storageParams || !storageParams.triggerFunctions || storageParams.triggerFunctions.length === 0) {
-              throw new Error('No triggers found associated with this table');
-            } else {
-              triggerName = await removeTrigger(context, defaultValues.resourceName, storageParams.triggerFunctions);
-
-              const index = storageParams.triggerFunctions.indexOf(triggerName);
-
-              if (index >= 0) {
-                storageParams.triggerFunctions.splice(index, 1);
-                continueWithTriggerOperationQuestion = false;
-              } else {
-                throw new Error('Could not find trigger function');
-              }
-            }
-          } catch (e) {
-            context.print.error(e.message);
-            continueWithTriggerOperationQuestion = true;
-          }
-
-          break;
-        }
-        case 'Skip Question': {
-          continueWithTriggerOperationQuestion = false;
-          break;
-        }
-        default:
-          context.print.error(`${triggerOperationAnswer.triggerOperation} not supported`);
-      }
-    }
-  }
-
-  const resource = defaultValues.resourceName;
-  const resourceDirPath = path.join(projectBackendDirPath, category, resource);
-
-  delete defaultValues.resourceName;
-
-  fs.ensureDirSync(resourceDirPath);
-
-  const parametersFilePath = path.join(resourceDirPath, parametersFileName);
-
-  // Copy just the table name as parameters
-  const parameters = {
-    tableName: defaultValues.tableName,
-    partitionKeyName,
-    partitionKeyType,
-  };
-
-  if (sortKeyName) {
-    Object.assign(parameters, { sortKeyName, sortKeyType });
-  }
-
-  let jsonString = JSON.stringify(parameters, null, 4);
-
-  fs.writeFileSync(parametersFilePath, jsonString, 'utf8');
-
-  const storageParamsFilePath = path.join(resourceDirPath, storageParamsFileName);
-
-  jsonString = JSON.stringify(storageParams, null, 4);
-
-  fs.writeFileSync(storageParamsFilePath, jsonString, 'utf8');
-
-  await copyCfnTemplate(context, resource, defaultValues);
-
-  return resource;
-}
-
-async function removeTrigger(context, resourceName, triggerList) {
-  const triggerOptionQuestion = {
-    type: 'list',
-    name: 'triggerOption',
-    message: 'Select from the function you would like to remove',
-    choices: triggerList,
-  };
-
-  const triggerOptionAnswer = await inquirer.prompt([triggerOptionQuestion]);
-
-  const functionName = triggerOptionAnswer.triggerOption;
-  const projectBackendDirPath = context.amplify.pathManager.getBackendDirPath();
-  const functionCFNFilePath = path.join(projectBackendDirPath, 'function', functionName, `${functionName}-cloudformation-template.json`);
-
-  if (fs.existsSync(functionCFNFilePath)) {
-    const functionCFNFile = context.amplify.readJsonFile(functionCFNFilePath);
-
-    delete functionCFNFile.Resources[`${resourceName}TriggerPolicy`];
-    delete functionCFNFile.Resources[`${resourceName}Trigger`];
-
-    // Update the functions resource
-    const functionCFNString = JSON.stringify(functionCFNFile, null, 4);
-
-    fs.writeFileSync(functionCFNFilePath, functionCFNString, 'utf8');
-  }
-
-  return functionName;
-}
-
-async function addTrigger(context, resourceName, triggerList) {
-  const triggerTypeQuestion = {
-    type: 'list',
-    name: 'triggerType',
-    message: 'Select from the following options',
-    choices: ['Choose an existing function from the project', 'Create a new function'],
-  };
-  const triggerTypeAnswer = await inquirer.prompt([triggerTypeQuestion]);
-  let functionName;
-
-  if (triggerTypeAnswer.triggerType === 'Choose an existing function from the project') {
-    let lambdaResources = await getLambdaFunctions(context);
-
-    if (triggerList) {
-      const filteredLambdaResources = [];
-
-      lambdaResources.forEach(lambdaResource => {
-        if (triggerList.indexOf(lambdaResource) === -1) {
-          filteredLambdaResources.push(lambdaResource);
-        }
-      });
-
-      lambdaResources = filteredLambdaResources;
-    }
-
-    if (lambdaResources.length === 0) {
-      throw new Error("No functions were found in the project. Use 'amplify add function' to add a new function.");
-    }
-
-    const triggerOptionQuestion = {
-      type: 'list',
-      name: 'triggerOption',
-      message: 'Select from the following options',
-      choices: lambdaResources,
-    };
-
-    const triggerOptionAnswer = await inquirer.prompt([triggerOptionQuestion]);
-
-    functionName = triggerOptionAnswer.triggerOption;
-  } else {
-    // Create a new lambda trigger
-
-    const targetDir = context.amplify.pathManager.getBackendDirPath();
-    const [shortId] = uuid().split('-');
-
-    functionName = `${resourceName}Trigger${shortId}`;
-
-    const pluginDir = __dirname;
-
-    const defaults = {
-      functionName: `${functionName}`,
-      roleName: `${resourceName}LambdaRole${shortId}`,
-    };
-
-    const copyJobs = [
-      {
-        dir: pluginDir,
-        template: path.join('..', '..', '..', '..', 'resources', 'triggers', 'dynamoDB', 'lambda-cloudformation-template.json.ejs'),
-        target: path.join(targetDir, 'function', functionName, `${functionName}-cloudformation-template.json`),
-      },
-      {
-        dir: pluginDir,
-        template: path.join('..', '..', '..', '..', 'resources', 'triggers', 'dynamoDB', 'event.json'),
-        target: path.join(targetDir, 'function', functionName, 'src', 'event.json'),
-      },
-      {
-        dir: pluginDir,
-        template: path.join('..', '..', '..', '..', 'resources', 'triggers', 'dynamoDB', 'index.js'),
-        target: path.join(targetDir, 'function', functionName, 'src', 'index.js'),
-      },
-      {
-        dir: pluginDir,
-        template: path.join('..', '..', '..', '..', 'resources', 'triggers', 'dynamoDB', 'package.json.ejs'),
-        target: path.join(targetDir, 'function', functionName, 'src', 'package.json'),
-      },
-    ];
-
-    // copy over the files
-    await context.amplify.copyBatch(context, copyJobs, defaults);
-
-    // Update amplify-meta and backend-config
-
-    const backendConfigs = {
-      service: FunctionServiceNameLambdaFunction,
-      providerPlugin: 'awscloudformation',
-      build: true,
-    };
-
-    context.amplify.updateamplifyMetaAfterResourceAdd('function', functionName, backendConfigs);
-
-    context.print.success(`Successfully added resource ${functionName} locally`);
-  }
-
-  const projectBackendDirPath = context.amplify.pathManager.getBackendDirPath();
-  const functionCFNFilePath = path.join(projectBackendDirPath, 'function', functionName, `${functionName}-cloudformation-template.json`);
-
-  if (fs.existsSync(functionCFNFilePath)) {
-    const functionCFNFile = context.amplify.readJsonFile(functionCFNFilePath);
-
-    // Update parameters block
-    functionCFNFile.Parameters[`storage${resourceName}Name`] = {
-      Type: 'String',
-      Default: `storage${resourceName}Name`,
-    };
-
-    functionCFNFile.Parameters[`storage${resourceName}Arn`] = {
-      Type: 'String',
-      Default: `storage${resourceName}Arn`,
-    };
-
-    functionCFNFile.Parameters[`storage${resourceName}StreamArn`] = {
-      Type: 'String',
-      Default: `storage${resourceName}Arn`,
-    };
-
-    // Update policies
-    functionCFNFile.Resources[`${resourceName}TriggerPolicy`] = {
-      DependsOn: ['LambdaExecutionRole'],
-      Type: 'AWS::IAM::Policy',
-      Properties: {
-        PolicyName: `lambda-trigger-policy-${resourceName}`,
-        Roles: [
-          {
-            Ref: 'LambdaExecutionRole',
-          },
-        ],
-        PolicyDocument: {
-          Version: '2012-10-17',
-          Statement: [
-            {
-              Effect: 'Allow',
-              Action: ['dynamodb:DescribeStream', 'dynamodb:GetRecords', 'dynamodb:GetShardIterator', 'dynamodb:ListStreams'],
-              Resource: [
-                {
-                  Ref: `storage${resourceName}StreamArn`,
-                },
-              ],
-            },
-          ],
-        },
-      },
-    };
-
-    // Add TriggerResource
-
-    functionCFNFile.Resources[`${resourceName}Trigger`] = {
-      Type: 'AWS::Lambda::EventSourceMapping',
-      DependsOn: [`${resourceName}TriggerPolicy`],
-      Properties: {
-        BatchSize: 100,
-        Enabled: true,
-        EventSourceArn: {
-          Ref: `storage${resourceName}StreamArn`,
-        },
-        FunctionName: {
-          'Fn::GetAtt': ['LambdaFunction', 'Arn'],
-        },
-        StartingPosition: 'LATEST',
-      },
-    };
-
-    // Update dependsOn
-
-    const amplifyMetaFilePath = context.amplify.pathManager.getAmplifyMetaFilePath();
-    const amplifyMeta = context.amplify.readJsonFile(amplifyMetaFilePath);
-
-    const resourceDependsOn = amplifyMeta.function[functionName].dependsOn || [];
-    let resourceExists = false;
-
-    resourceDependsOn.forEach(resource => {
-      if (resource.resourceName === resourceName) {
-        resourceExists = true;
-        resourceDependsOn.attributes = ['Name', 'Arn', 'StreamArn'];
-      }
-    });
-
-    if (!resourceExists) {
-      resourceDependsOn.push({
-        category: 'storage',
-        resourceName,
-        attributes: ['Name', 'Arn', 'StreamArn'],
-      });
-    }
-
-    // Update the functions resource
-    const functionCFNString = JSON.stringify(functionCFNFile, null, 4);
-
-    fs.writeFileSync(functionCFNFilePath, functionCFNString, 'utf8');
-
-    context.amplify.updateamplifyMetaAfterResourceUpdate('function', functionName, 'dependsOn', resourceDependsOn);
-    context.print.success(`Successfully updated resource ${functionName} locally`);
-
-    if (await context.amplify.confirmPrompt(`Do you want to edit the local ${functionName} lambda function now?`)) {
-      await context.amplify.openEditor(context, `${projectBackendDirPath}/function/${functionName}/src/index.js`);
-    }
-  } else {
-    throw new Error(`Function ${functionName} does not exist`);
-  }
-
-  return functionName;
-}
-
-async function getLambdaFunctions(context) {
-  const { allResources } = await context.amplify.getResourceStatus();
-  const lambdaResources = allResources
-    .filter(resource => resource.service === FunctionServiceNameLambdaFunction)
-    .map(resource => resource.resourceName);
-
-  return lambdaResources;
-}
-
-function copyCfnTemplate(context, resourceName, options) {
-  const pluginDir = __dirname;
-  const copyJobs = [
-    {
-      dir: pluginDir,
-      template: path.join('..', '..', '..', '..', 'resources', 'cloudformation-templates', templateFileName),
-      target: getCloudFormationTemplatePath(resourceName),
-    },
-  ];
-
-  // copy over the files
-  return context.amplify.copyBatch(context, copyJobs, options);
-}
-
-function migrate(context, projectPath, resourceName) {
-  const resourceDirPath = path.join(projectPath, 'amplify', 'backend', category, resourceName);
-  const cfnFilePath = path.join(resourceDirPath, `${resourceName}-cloudformation-template.json`);
-
-  // Removes dangling commas from a JSON
-  const removeDanglingCommas = value => {
-    const regex = /,(?!\s*?[{["'\w])/g;
-
-    return value.replace(regex, '');
-  };
-
-  /* Current Dynamo CFN's have a trailing comma (accepted by CFN),
-  but fails on JSON.parse(), hence removing it */
-
-  let oldcfnString = fs.readFileSync(cfnFilePath, 'utf8');
-  oldcfnString = removeDanglingCommas(oldcfnString);
-
-  const oldCfn = JSON.parse(oldcfnString);
-
-  const newCfn = {};
-
-  Object.assign(newCfn, oldCfn);
-
-  // Add env parameter
-  if (!newCfn.Parameters) {
-    newCfn.Parameters = {};
-  }
-
-  newCfn.Parameters.env = {
-    Type: 'String',
-  };
-
-  // Add conditions block
-  if (!newCfn.Conditions) {
-    newCfn.Conditions = {};
-  }
-
-  newCfn.Conditions.ShouldNotCreateEnvResources = {
-    'Fn::Equals': [
-      {
-        Ref: 'env',
-      },
-      'NONE',
-    ],
-  };
-
-  // Add if condition for resource name change
-
-  newCfn.Resources.DynamoDBTable.Properties.TableName = {
-    'Fn::If': [
-      'ShouldNotCreateEnvResources',
-      {
-        Ref: 'tableName',
-      },
-      {
-        'Fn::Join': [
-          '',
-          [
-            {
-              Ref: 'tableName',
-            },
-            '-',
-            {
-              Ref: 'env',
-            },
-          ],
-        ],
-      },
-    ],
-  };
-
-  const jsonString = JSON.stringify(newCfn, null, '\t');
-
-  fs.writeFileSync(cfnFilePath, jsonString, 'utf8');
-}
-
-function getIAMPolicies(resourceName, crudOptions) {
-  let policy = {};
-  const actions = [];
-
-  crudOptions.forEach(crudOption => {
-    switch (crudOption) {
-      case 'create':
-        actions.push('dynamodb:Put*', 'dynamodb:Create*', 'dynamodb:BatchWriteItem');
-        break;
-      case 'update':
-        actions.push('dynamodb:Update*', 'dynamodb:RestoreTable*');
-        break;
-      case 'read':
-        actions.push('dynamodb:Get*', 'dynamodb:BatchGetItem', 'dynamodb:List*', 'dynamodb:Describe*', 'dynamodb:Scan', 'dynamodb:Query');
-        break;
-      case 'delete':
-        actions.push('dynamodb:Delete*');
-        break;
-      default:
-        console.log(`${crudOption} not supported`);
-    }
-  });
-
-  policy = {
-    Effect: 'Allow',
-    Action: actions,
-    Resource: crudOptions.customPolicyResource
-      ? crudOptions.customPolicyResource
-      : [
-          { Ref: `${category}${resourceName}Arn` },
-          {
-            'Fn::Join': [
-              '/',
-              [
-                {
-                  Ref: `${category}${resourceName}Arn`,
-                },
-                'index/*',
-              ],
-            ],
-          },
-        ],
-  };
-
-  const attributes = ['Name', 'Arn', 'StreamArn'];
-
-  return { policy, attributes };
-}
-
-module.exports = {
-  addWalkthrough,
-  updateWalkthrough,
-  migrate,
-  getIAMPolicies,
-};
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.ts b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.ts
new file mode 100644
index 00000000000..2934af82a24
--- /dev/null
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.ts
@@ -0,0 +1,784 @@
+import * as path from 'path';
+import * as fs from 'fs-extra';
+import uuid from 'uuid';
+import { alphanumeric, printer, prompter, Validator } from 'amplify-prompts';
+import { $TSContext, AmplifyCategories, ResourceDoesNotExistError, exitOnNextTick } from 'amplify-cli-core';
+import { DynamoDBInputState } from './dynamoDB-input-state';
+import {
+  DynamoDBAttributeDefType,
+  DynamoDBCLIInputs,
+  DynamoDBCLIInputsGSIType,
+  DynamoDBCLIInputsKeyType,
+} from '../service-walkthrough-types/dynamoDB-user-input-types';
+import { DDBStackTransform } from '../cdk-stack-builder/ddb-stack-transform';
+
+// keep in sync with ServiceName in amplify-AmplifyCategories.STORAGE-function, but probably it will not change
+const FunctionServiceNameLambdaFunction = 'Lambda';
+const serviceName = 'DynamoDB';
+
+async function addWalkthrough(context: $TSContext, defaultValuesFilename: string) {
+  printer.blankLine();
+  printer.info('Welcome to the NoSQL DynamoDB database wizard');
+  printer.info('This wizard asks you a series of questions to help determine how to set up your NoSQL database table.');
+  printer.blankLine();
+
+  const defaultValuesSrc = path.join(__dirname, '..', 'default-values', defaultValuesFilename);
+  const { getAllDefaults } = require(defaultValuesSrc);
+  const { amplify } = context;
+  const defaultValues = getAllDefaults(amplify.getProjectDetails());
+
+  const resourceName = await askResourceNameQuestion(defaultValues); // Cannot be changed once added
+  const tableName = await askTableNameQuestion(defaultValues, resourceName); // Cannot be changed once added
+
+  const { attributeAnswers, indexableAttributeList } = await askAttributeListQuestion();
+
+  const partitionKey = await askPrimaryKeyQuestion(indexableAttributeList, attributeAnswers); // Cannot be changed once added
+
+  let cliInputs: DynamoDBCLIInputs = {
+    resourceName,
+    tableName,
+    partitionKey,
+  };
+
+  cliInputs.sortKey = await askSortKeyQuestion(indexableAttributeList, attributeAnswers, cliInputs.partitionKey.fieldName);
+
+  cliInputs.gsi = await askGSIQuestion(indexableAttributeList, attributeAnswers);
+
+  cliInputs.triggerFunctions = await askTriggersQuestion(context, cliInputs.resourceName);
+
+  const cliInputsState = new DynamoDBInputState(cliInputs.resourceName);
+  cliInputsState.saveCliInputPayload(cliInputs);
+
+  const stackGenerator = new DDBStackTransform(cliInputs.resourceName);
+  stackGenerator.transform();
+
+  return cliInputs.resourceName;
+}
+
+async function updateWalkthrough(context: $TSContext) {
+  // const resourceName = resourceAlreadyExists(context);
+  const { amplify } = context;
+  const { amplifyMeta } = amplify.getProjectDetails();
+
+  const dynamoDbResources: any = {};
+
+  Object.keys(amplifyMeta[AmplifyCategories.STORAGE]).forEach(resourceName => {
+    if (
+      amplifyMeta[AmplifyCategories.STORAGE][resourceName].service === serviceName &&
+      amplifyMeta[AmplifyCategories.STORAGE][resourceName].mobileHubMigrated !== true &&
+      amplifyMeta[AmplifyCategories.STORAGE][resourceName].serviceType !== 'imported'
+    ) {
+      dynamoDbResources[resourceName] = amplifyMeta[AmplifyCategories.STORAGE][resourceName];
+    }
+  });
+
+  if (!amplifyMeta[AmplifyCategories.STORAGE] || Object.keys(dynamoDbResources).length === 0) {
+    const errMessage = 'No resources to update. You need to add a resource.';
+
+    printer.error(errMessage);
+    context.usageData.emitError(new ResourceDoesNotExistError(errMessage));
+    exitOnNextTick(0);
+    return;
+  }
+
+  const resources = Object.keys(dynamoDbResources);
+  const resourceName = await prompter.pick('Specify the resource that you would want to update', resources);
+
+  // Check if we need to migrate to cli-inputs.json
+  const cliInputsState = new DynamoDBInputState(resourceName);
+
+  if (!cliInputsState.cliInputFileExists()) {
+    if (context.exeInfo?.forcePush || (await prompter.yesOrNo('File migration required to continue. Do you want to continue?', true))) {
+      cliInputsState.migrate();
+      const stackGenerator = new DDBStackTransform(resourceName);
+      stackGenerator.transform();
+    } else {
+      return;
+    }
+  }
+
+  const cliInputs = cliInputsState.getCliInputPayload();
+
+  let existingAttributeDefinitions: DynamoDBCLIInputsKeyType[] = [];
+
+  if (cliInputs.partitionKey) {
+    existingAttributeDefinitions.push(cliInputs.partitionKey);
+  }
+  if (cliInputs.sortKey) {
+    existingAttributeDefinitions.push(cliInputs.sortKey);
+  }
+  if (cliInputs.gsi && cliInputs.gsi.length > 0) {
+    cliInputs.gsi.forEach((gsi: DynamoDBCLIInputsGSIType) => {
+      if (gsi.partitionKey) {
+        existingAttributeDefinitions.push(gsi.partitionKey);
+      }
+      if (gsi.sortKey) {
+        existingAttributeDefinitions.push(gsi.sortKey);
+      }
+    });
+  }
+
+  if (!cliInputs.resourceName) {
+    throw new Error('resourceName not found in cli-inputs');
+  }
+
+  const { attributeAnswers, indexableAttributeList } = await askAttributeListQuestion(existingAttributeDefinitions);
+
+  cliInputs.gsi = await askGSIQuestion(indexableAttributeList, attributeAnswers, cliInputs.gsi);
+  cliInputs.triggerFunctions = await askTriggersQuestion(context, cliInputs.resourceName, cliInputs.triggerFunctions);
+
+  cliInputsState.saveCliInputPayload(cliInputs);
+
+  const stackGenerator = new DDBStackTransform(cliInputs.resourceName);
+  stackGenerator.transform();
+
+  return cliInputs;
+}
+
+async function askTriggersQuestion(context: $TSContext, resourceName: string, existingTriggerFunctions?: string[]): Promise<string[]> {
+  let triggerFunctions: string[] = existingTriggerFunctions || [];
+
+  if (!existingTriggerFunctions || existingTriggerFunctions.length === 0) {
+    if (await prompter.confirmContinue('Do you want to add a Lambda Trigger for your Table?')) {
+      let triggerName;
+      try {
+        // @ts-expect-error ts-migrate(2554) FIXME: Expected 3 arguments, but got 2.
+        triggerName = await addTrigger(context, resourceName);
+        return [triggerName];
+      } catch (e) {
+        printer.error(e.message);
+      }
+    }
+  } else {
+    let triggerName;
+    let continueWithTriggerOperationQuestion = true;
+
+    while (continueWithTriggerOperationQuestion) {
+      const triggerOperationAnswer = await prompter.pick('Select from the following options', [
+        'Add a Trigger',
+        'Remove a trigger',
+        `I'm done`,
+      ]);
+
+      switch (triggerOperationAnswer) {
+        case 'Add a Trigger': {
+          try {
+            triggerName = await addTrigger(context, resourceName, triggerFunctions);
+            triggerFunctions.push(triggerName);
+            continueWithTriggerOperationQuestion = false;
+          } catch (e) {
+            printer.error(e.message);
+            continueWithTriggerOperationQuestion = true;
+          }
+          break;
+        }
+        case 'Remove a trigger': {
+          try {
+            if (triggerFunctions.length === 0) {
+              throw new Error('No triggers found associated with this table');
+            } else {
+              triggerName = await removeTrigger(context, resourceName, triggerFunctions);
+
+              const index = triggerFunctions.indexOf(triggerName);
+
+              if (index >= 0) {
+                triggerFunctions.splice(index, 1);
+                continueWithTriggerOperationQuestion = false;
+              } else {
+                throw new Error('Could not find trigger function');
+              }
+            }
+          } catch (e) {
+            printer.error(e.message);
+            continueWithTriggerOperationQuestion = true;
+          }
+
+          break;
+        }
+        case `I'm done`: {
+          continueWithTriggerOperationQuestion = false;
+          break;
+        }
+        default:
+          printer.error(`${triggerOperationAnswer} not supported`);
+      }
+    }
+  }
+  return triggerFunctions;
+}
+
+async function askGSIQuestion(
+  indexableAttributeList: string[],
+  attributeDefinitions: DynamoDBAttributeDefType[],
+  existingGSIList?: DynamoDBCLIInputsGSIType[],
+) {
+  printer.blankLine();
+  printer.info(
+    'You can optionally add global secondary indexes for this table. These are useful when you run queries defined in a different column than the primary key.',
+  );
+  printer.info('To learn more about indexes, see:');
+  printer.info(
+    'https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.CoreComponents.html#HowItWorks.CoreComponents.SecondaryIndexes',
+  );
+  printer.blankLine();
+
+  let gsiList: DynamoDBCLIInputsGSIType[] = [];
+
+  if (
+    existingGSIList &&
+    !!existingGSIList.length &&
+    (await prompter.yesOrNo('Do you want to keep existing global seconday indexes created on your table?', true))
+  ) {
+    gsiList = existingGSIList;
+  }
+
+  if (await prompter.confirmContinue('Do you want to add global secondary indexes to your table?')) {
+    let continuewithGSIQuestions = true;
+
+    while (continuewithGSIQuestions) {
+      if (indexableAttributeList.length > 0) {
+        const gsiNameValidator =
+          (message: string): Validator =>
+          (input: string) =>
+            /^[a-zA-Z0-9_-]+$/.test(input) ? true : message;
+
+        const gsiName = await prompter.input('Provide the GSI name', {
+          validate: gsiNameValidator('You can use the following characters: a-z A-Z 0-9 - _'),
+        });
+
+        const gsiPartitionKeyName = await prompter.pick('Choose partition key for the GSI', [...new Set(indexableAttributeList)]);
+
+        const gsiPrimaryKeyIndex = attributeDefinitions.findIndex(
+          (attr: DynamoDBAttributeDefType) => attr.AttributeName === gsiPartitionKeyName,
+        );
+
+        /* eslint-enable */
+        let gsiItem: DynamoDBCLIInputsGSIType = {
+          name: gsiName,
+          partitionKey: {
+            fieldName: gsiPartitionKeyName,
+            fieldType: attributeDefinitions[gsiPrimaryKeyIndex].AttributeType,
+          },
+        };
+
+        const sortKeyOptions = indexableAttributeList.filter((att: string) => att !== gsiPartitionKeyName);
+
+        if (sortKeyOptions.length > 0) {
+          if (await prompter.confirmContinue('Do you want to add a sort key to your global secondary index?')) {
+            const gsiSortKeyName = await prompter.pick('Choose sort key for the GSI', [...new Set(sortKeyOptions)]);
+            const gsiSortKeyIndex = attributeDefinitions.findIndex(
+              (attr: DynamoDBAttributeDefType) => attr.AttributeName === gsiSortKeyName,
+            );
+
+            gsiItem.sortKey = {
+              fieldName: gsiSortKeyName,
+              fieldType: attributeDefinitions[gsiSortKeyIndex].AttributeType,
+            };
+          }
+        }
+
+        gsiList.push(gsiItem);
+        continuewithGSIQuestions = await prompter.confirmContinue('Do you want to add more global secondary indexes to your table?');
+      } else {
+        printer.error('You do not have any other attributes remaining to configure');
+        break;
+      }
+    }
+  }
+  return gsiList;
+}
+
+async function askSortKeyQuestion(
+  indexableAttributeList: string[],
+  attributeDefinitions: DynamoDBAttributeDefType[],
+  partitionKeyFieldName: string,
+): Promise<undefined | DynamoDBCLIInputsKeyType> {
+  if (await prompter.confirmContinue('Do you want to add a sort key to your table?')) {
+    // Ask for sort key
+    if (attributeDefinitions.length > 1) {
+      const sortKeyName = await prompter.pick(
+        'Choose sort key for the table',
+        indexableAttributeList.filter((att: string) => att !== partitionKeyFieldName),
+      );
+      const sortKeyAttrTypeIndex = attributeDefinitions.findIndex((attr: DynamoDBAttributeDefType) => attr.AttributeName === sortKeyName);
+
+      return {
+        fieldName: sortKeyName,
+        fieldType: attributeDefinitions[sortKeyAttrTypeIndex].AttributeType,
+      };
+    } else {
+      printer.error('You must add additional keys in order to select a sort key.');
+    }
+  }
+  return;
+}
+
+async function askPrimaryKeyQuestion(indexableAttributeList: string[], attributeDefinitions: DynamoDBAttributeDefType[]) {
+  printer.blankLine();
+  printer.info(
+    'Before you create the database, you must specify how items in your table are uniquely organized. You do this by specifying a primary key. The primary key uniquely identifies each item in the table so that no two items can have the same key. This can be an individual column, or a combination that includes a primary key and a sort key.',
+  );
+  printer.blankLine();
+  printer.info('To learn more about primary keys, see:');
+  printer.info(
+    'https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.CoreComponents.html#HowItWorks.CoreComponents.PrimaryKey',
+  );
+  printer.blankLine();
+
+  const partitionKeyName = await prompter.pick('Choose partition key for the table', indexableAttributeList);
+  const primaryAttrTypeIndex = attributeDefinitions.findIndex((attr: DynamoDBAttributeDefType) => attr.AttributeName === partitionKeyName);
+
+  return {
+    fieldName: partitionKeyName,
+    fieldType: attributeDefinitions[primaryAttrTypeIndex].AttributeType,
+  };
+}
+
+async function askAttributeListQuestion(existingAttributeDefinitions?: DynamoDBCLIInputsKeyType[]) {
+  const attributeTypes = {
+    string: { code: 'string', indexable: true },
+    number: { code: 'number', indexable: true },
+    binary: { code: 'binary', indexable: true },
+    boolean: { code: 'boolean', indexable: false },
+    list: { code: 'list', indexable: false },
+    map: { code: 'map', indexable: false },
+    null: { code: 'null', indexable: false },
+    'string-set': { code: 'string-set', indexable: false },
+    'number-set': { code: 'number-set', indexable: false },
+    'binary-set': { code: 'binary-set', indexable: false },
+  };
+
+  printer.blankLine();
+  printer.info('You can now add columns to the table.');
+  printer.blankLine();
+
+  let continueAttributeQuestion = true;
+  let attributeAnswers: DynamoDBAttributeDefType[] = [];
+  let indexableAttributeList: string[] = [];
+  let existingAttributes: DynamoDBAttributeDefType[] = [];
+
+  if (existingAttributeDefinitions) {
+    existingAttributes = existingAttributeDefinitions.map((attr: DynamoDBCLIInputsKeyType) => {
+      return {
+        AttributeName: attr.fieldName,
+        AttributeType: attr.fieldType,
+      };
+    });
+  }
+
+  if (existingAttributes.length > 0) {
+    attributeAnswers = existingAttributes;
+    indexableAttributeList = attributeAnswers.map((attr: DynamoDBAttributeDefType) => attr.AttributeName);
+    continueAttributeQuestion = await prompter.confirmContinue('Would you like to add another column?');
+  }
+
+  while (continueAttributeQuestion) {
+    const attributeNameValidator =
+      (message: string): Validator =>
+      (input: string) =>
+        /^[a-zA-Z0-9_-]+$/.test(input) ? true : message;
+
+    const attributeName = await prompter.input('What would you like to name this column', {
+      validate: attributeNameValidator('You can use the following characters: a-z A-Z 0-9 - _'),
+    });
+
+    const attributeType = await prompter.pick('Choose the data type', Object.keys(attributeTypes));
+
+    if (attributeAnswers.findIndex((attribute: DynamoDBAttributeDefType) => attribute.AttributeName === attributeName) !== -1) {
+      continueAttributeQuestion = await prompter.confirmContinue('This attribute was already added. Do you want to add another attribute?');
+      continue;
+    }
+
+    attributeAnswers.push({
+      AttributeName: attributeName,
+      // @ts-expect-error ts-migrate(7053) FIXME: Element implicitly has an 'any' type because expre... Remove this comment to see the full error message
+      AttributeType: attributeTypes[attributeType].code,
+    });
+
+    // @ts-expect-error ts-migrate(7053) FIXME: Element implicitly has an 'any' type because expre... Remove this comment to see the full error message
+    if (attributeTypes[attributeType].indexable) {
+      indexableAttributeList.push(attributeName);
+    }
+
+    continueAttributeQuestion = await prompter.confirmContinue('Would you like to add another column?');
+  }
+
+  return { attributeAnswers, indexableAttributeList };
+}
+
+async function askTableNameQuestion(defaultValues: any, resourceName: string) {
+  const tableNameValidator =
+    (message: string): Validator =>
+    (input: string) =>
+      /^[a-zA-Z0-9._-]+$/.test(input) ? true : message;
+
+  const tableName = await prompter.input('Provide table name:', {
+    validate: tableNameValidator('You can use the following characters: a-z A-Z 0-9 . - _'),
+    initial: resourceName || defaultValues['tableName'],
+  });
+
+  return tableName;
+}
+
+async function askResourceNameQuestion(defaultValues: any): Promise<string> {
+  const resourceName = await prompter.input(
+    'Provide a friendly name for your resource that will be used to label this category in the project',
+    {
+      validate: alphanumeric(),
+      initial: defaultValues['resourceName'],
+    },
+  );
+
+  return resourceName;
+}
+
+async function removeTrigger(context: $TSContext, resourceName: string, triggerList: string[]) {
+  const functionName = await prompter.pick('Select from the function you would like to remove', triggerList);
+
+  const projectBackendDirPath = context.amplify.pathManager.getBackendDirPath();
+  const functionCFNFilePath = path.join(projectBackendDirPath, 'function', functionName, `${functionName}-cloudformation-template.json`);
+
+  if (fs.existsSync(functionCFNFilePath)) {
+    const functionCFNFile = context.amplify.readJsonFile(functionCFNFilePath);
+
+    delete functionCFNFile.Resources[`${resourceName}TriggerPolicy`];
+    delete functionCFNFile.Resources[`${resourceName}Trigger`];
+
+    // Update the functions resource
+    const functionCFNString = JSON.stringify(functionCFNFile, null, 4);
+
+    fs.writeFileSync(functionCFNFilePath, functionCFNString, 'utf8');
+  }
+
+  return functionName;
+}
+
+async function addTrigger(context: $TSContext, resourceName: string, triggerList: string[]) {
+  const triggerTypeAnswer = await prompter.pick('Select from the following options', [
+    'Choose an existing function from the project',
+    'Create a new function',
+  ]);
+  let functionName;
+
+  if (triggerTypeAnswer === 'Choose an existing function from the project') {
+    let lambdaResources = await getLambdaFunctions(context);
+
+    if (triggerList) {
+      const filteredLambdaResources: string[] = [];
+
+      lambdaResources.forEach((lambdaResource: string) => {
+        if (triggerList.indexOf(lambdaResource) === -1) {
+          filteredLambdaResources.push(lambdaResource);
+        }
+      });
+
+      lambdaResources = filteredLambdaResources;
+    }
+
+    if (lambdaResources.length === 0) {
+      throw new Error("No functions were found in the project. Use 'amplify add function' to add a new function.");
+    }
+
+    functionName = await prompter.pick('Select from the following options', lambdaResources);
+  } else {
+    // Create a new lambda trigger
+
+    const targetDir = context.amplify.pathManager.getBackendDirPath();
+    const [shortId] = uuid().split('-');
+
+    functionName = `${resourceName}Trigger${shortId}`;
+
+    const pluginDir = __dirname;
+
+    const defaults = {
+      functionName: `${functionName}`,
+      roleName: `${resourceName}LambdaRole${shortId}`,
+    };
+
+    const copyJobs = [
+      {
+        dir: pluginDir,
+        template: path.join('..', '..', '..', '..', 'resources', 'triggers', 'dynamoDB', 'lambda-cloudformation-template.json.ejs'),
+        target: path.join(targetDir, 'function', functionName, `${functionName}-cloudformation-template.json`),
+      },
+      {
+        dir: pluginDir,
+        template: path.join('..', '..', '..', '..', 'resources', 'triggers', 'dynamoDB', 'event.json'),
+        target: path.join(targetDir, 'function', functionName, 'src', 'event.json'),
+      },
+      {
+        dir: pluginDir,
+        template: path.join('..', '..', '..', '..', 'resources', 'triggers', 'dynamoDB', 'index.js'),
+        target: path.join(targetDir, 'function', functionName, 'src', 'index.js'),
+      },
+      {
+        dir: pluginDir,
+        template: path.join('..', '..', '..', '..', 'resources', 'triggers', 'dynamoDB', 'package.json.ejs'),
+        target: path.join(targetDir, 'function', functionName, 'src', 'package.json'),
+      },
+    ];
+
+    // copy over the files
+    await context.amplify.copyBatch(context, copyJobs, defaults);
+
+    // Update amplify-meta and backend-config
+
+    const backendConfigs = {
+      service: FunctionServiceNameLambdaFunction,
+      providerPlugin: 'awscloudformation',
+      build: true,
+    };
+
+    context.amplify.updateamplifyMetaAfterResourceAdd('function', functionName, backendConfigs);
+
+    printer.success(`Successfully added resource ${functionName} locally`);
+  }
+
+  const projectBackendDirPath = context.amplify.pathManager.getBackendDirPath();
+  const functionCFNFilePath = path.join(projectBackendDirPath, 'function', functionName, `${functionName}-cloudformation-template.json`);
+
+  if (fs.existsSync(functionCFNFilePath)) {
+    const functionCFNFile = context.amplify.readJsonFile(functionCFNFilePath);
+
+    // Update parameters block
+    functionCFNFile.Parameters[`storage${resourceName}Name`] = {
+      Type: 'String',
+      Default: `storage${resourceName}Name`,
+    };
+
+    functionCFNFile.Parameters[`storage${resourceName}Arn`] = {
+      Type: 'String',
+      Default: `storage${resourceName}Arn`,
+    };
+
+    functionCFNFile.Parameters[`storage${resourceName}StreamArn`] = {
+      Type: 'String',
+      Default: `storage${resourceName}Arn`,
+    };
+
+    // Update policies
+    functionCFNFile.Resources[`${resourceName}TriggerPolicy`] = {
+      DependsOn: ['LambdaExecutionRole'],
+      Type: 'AWS::IAM::Policy',
+      Properties: {
+        PolicyName: `lambda-trigger-policy-${resourceName}`,
+        Roles: [
+          {
+            Ref: 'LambdaExecutionRole',
+          },
+        ],
+        PolicyDocument: {
+          Version: '2012-10-17',
+          Statement: [
+            {
+              Effect: 'Allow',
+              Action: ['dynamodb:DescribeStream', 'dynamodb:GetRecords', 'dynamodb:GetShardIterator', 'dynamodb:ListStreams'],
+              Resource: [
+                {
+                  Ref: `storage${resourceName}StreamArn`,
+                },
+              ],
+            },
+          ],
+        },
+      },
+    };
+
+    // Add TriggerResource
+
+    functionCFNFile.Resources[`${resourceName}Trigger`] = {
+      Type: 'AWS::Lambda::EventSourceMapping',
+      DependsOn: [`${resourceName}TriggerPolicy`],
+      Properties: {
+        BatchSize: 100,
+        Enabled: true,
+        EventSourceArn: {
+          Ref: `storage${resourceName}StreamArn`,
+        },
+        FunctionName: {
+          'Fn::GetAtt': ['LambdaFunction', 'Arn'],
+        },
+        StartingPosition: 'LATEST',
+      },
+    };
+
+    // Update dependsOn
+
+    const amplifyMetaFilePath = context.amplify.pathManager.getAmplifyMetaFilePath();
+    const amplifyMeta = context.amplify.readJsonFile(amplifyMetaFilePath);
+
+    const resourceDependsOn = amplifyMeta.function[functionName].dependsOn || [];
+    let resourceExists = false;
+
+    resourceDependsOn.forEach((resource: any) => {
+      if (resource.resourceName === resourceName) {
+        resourceExists = true;
+        resourceDependsOn.attributes = ['Name', 'Arn', 'StreamArn'];
+      }
+    });
+
+    if (!resourceExists) {
+      resourceDependsOn.push({
+        category: AmplifyCategories.STORAGE,
+        resourceName,
+        attributes: ['Name', 'Arn', 'StreamArn'],
+      });
+    }
+
+    // Update the functions resource
+    const functionCFNString = JSON.stringify(functionCFNFile, null, 4);
+
+    fs.writeFileSync(functionCFNFilePath, functionCFNString, 'utf8');
+
+    context.amplify.updateamplifyMetaAfterResourceUpdate('function', functionName, 'dependsOn', resourceDependsOn);
+    printer.success(`Successfully updated resource ${functionName} locally`);
+
+    if (await prompter.confirmContinue(`Do you want to edit the local ${functionName} lambda function now?`)) {
+      await context.amplify.openEditor(context, `${projectBackendDirPath}/function/${functionName}/src/index.js`);
+    }
+  } else {
+    throw new Error(`Function ${functionName} does not exist`);
+  }
+
+  return functionName;
+}
+
+async function getLambdaFunctions(context: $TSContext) {
+  const { allResources } = await context.amplify.getResourceStatus();
+  const lambdaResources = allResources
+    .filter((resource: any) => resource.service === FunctionServiceNameLambdaFunction)
+    .map((resource: any) => resource.resourceName);
+
+  return lambdaResources;
+}
+
+function migrateCategory(context: $TSContext, projectPath: any, resourceName: any) {
+  const resourceDirPath = path.join(projectPath, 'amplify', 'backend', AmplifyCategories.STORAGE, resourceName);
+  const cfnFilePath = path.join(resourceDirPath, `${resourceName}-cloudformation-template.json`);
+
+  // Removes dangling commas from a JSON
+  const removeDanglingCommas = (value: any) => {
+    const regex = /,(?!\s*?[{["'\w])/g;
+
+    return value.replace(regex, '');
+  };
+
+  /* Current Dynamo CFN's have a trailing comma (accepted by CFN),
+  but fails on JSON.parse(), hence removing it */
+
+  let oldcfnString = fs.readFileSync(cfnFilePath, 'utf8');
+  oldcfnString = removeDanglingCommas(oldcfnString);
+
+  const oldCfn = JSON.parse(oldcfnString);
+
+  const newCfn = {};
+
+  Object.assign(newCfn, oldCfn);
+
+  // Add env parameter
+  if (!(newCfn as any).Parameters) {
+    (newCfn as any).Parameters = {};
+  }
+
+  (newCfn as any).Parameters.env = {
+    Type: 'String',
+  };
+
+  // Add conditions block
+  if (!(newCfn as any).Conditions) {
+    (newCfn as any).Conditions = {};
+  }
+
+  (newCfn as any).Conditions.ShouldNotCreateEnvResources = {
+    'Fn::Equals': [
+      {
+        Ref: 'env',
+      },
+      'NONE',
+    ],
+  };
+
+  // Add if condition for resource name change
+  (newCfn as any).Resources.DynamoDBTable.Properties.TableName = {
+    'Fn::If': [
+      'ShouldNotCreateEnvResources',
+      {
+        Ref: 'tableName',
+      },
+      {
+        'Fn::Join': [
+          '',
+          [
+            {
+              Ref: 'tableName',
+            },
+            '-',
+            {
+              Ref: 'env',
+            },
+          ],
+        ],
+      },
+    ],
+  };
+
+  const jsonString = JSON.stringify(newCfn, null, '\t');
+
+  fs.writeFileSync(cfnFilePath, jsonString, 'utf8');
+}
+
+function getIAMPolicies(resourceName: any, crudOptions: any) {
+  let policy = {};
+  const actions: any = [];
+
+  crudOptions.forEach((crudOption: any) => {
+    switch (crudOption) {
+      case 'create':
+        actions.push('dynamodb:Put*', 'dynamodb:Create*', 'dynamodb:BatchWriteItem');
+        break;
+      case 'update':
+        actions.push('dynamodb:Update*', 'dynamodb:RestoreTable*');
+        break;
+      case 'read':
+        actions.push('dynamodb:Get*', 'dynamodb:BatchGetItem', 'dynamodb:List*', 'dynamodb:Describe*', 'dynamodb:Scan', 'dynamodb:Query');
+        break;
+      case 'delete':
+        actions.push('dynamodb:Delete*');
+        break;
+      default:
+        console.log(`${crudOption} not supported`);
+    }
+  });
+
+  policy = {
+    Effect: 'Allow',
+    Action: actions,
+    Resource: crudOptions.customPolicyResource
+      ? crudOptions.customPolicyResource
+      : [
+          { Ref: `${AmplifyCategories.STORAGE}${resourceName}Arn` },
+          {
+            'Fn::Join': [
+              '/',
+              [
+                {
+                  Ref: `${AmplifyCategories.STORAGE}${resourceName}Arn`,
+                },
+                'index/*',
+              ],
+            ],
+          },
+        ],
+  };
+
+  const attributes = ['Name', 'Arn', 'StreamArn'];
+
+  return { policy, attributes };
+}
+
+module.exports = {
+  addWalkthrough,
+  updateWalkthrough,
+  migrate: migrateCategory,
+  getIAMPolicies,
+};
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/s3-user-input-state.ts b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/s3-user-input-state.ts
new file mode 100644
index 00000000000..be2288064ca
--- /dev/null
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/s3-user-input-state.ts
@@ -0,0 +1,162 @@
+import { S3AccessType, S3PermissionType, S3UserInputs } from '../service-walkthrough-types/s3-user-input-types';
+import { AmplifyCategories, AmplifySupportedService } from 'amplify-cli-core';
+import { JSONUtilities, pathManager } from 'amplify-cli-core';
+import { CLIInputSchemaValidator } from 'amplify-cli-core';
+
+import * as fs from 'fs-extra';
+import * as path from 'path';
+
+type ResourcRefType = {
+  Ref: string;
+};
+
+export enum S3CFNPermissionType {
+  PUT_OBJECT = 's3:PutObject',
+  GET_OBJECT = 's3:GetObject',
+  DELETE_OBJECT = 's3:DeleteObject',
+  LIST_BUCKET = 's3:ListBucket',
+}
+
+export type S3CFNDependsOn = {
+  category: string;
+  resourceName: string;
+  attributes: string[];
+};
+
+export type S3CLIWalkthroughParams = {
+  resourceName: string;
+  bucketName: string;
+  authPolicyName: string;
+  unauthPolicyName: string;
+  authRoleName: ResourcRefType;
+  unauthRoleName: ResourcRefType;
+  storageAccess: S3AccessType;
+  selectedGuestPermissions: S3CFNPermissionType[];
+  selectedAuthenticatedPermissions: S3CFNPermissionType[];
+  s3PermissionsAuthenticatedPublic: string;
+  s3PublicPolicy: string;
+  s3PermissionsAuthenticatedUploads: string;
+  s3UploadsPolicy: string;
+  s3PermissionsAuthenticatedProtected: string;
+  s3ProtectedPolicy: string;
+  s3PermissionsAuthenticatedPrivate: string;
+  s3PrivatePolicy: string;
+  AuthenticatedAllowList: string;
+  s3ReadPolicy: string;
+  s3PermissionsGuestPublic: string;
+  s3PermissionsGuestUploads: string;
+  GuestAllowList: string;
+  triggerFunction: string;
+  service: string;
+  providerPlugin: string;
+  dependsOn: S3CFNDependsOn[];
+};
+
+export type S3InputStateOptions = {
+  userInputDataFilename: string; //cli-inputs.json
+  resourceName: string;
+  inputPayload?: S3UserInputs;
+};
+
+export class S3InputState {
+  static s3InputState: S3InputState;
+  _cliInputsFilePath: string; //cli-inputs.json (output) filepath
+  _resourceName: string; //user friendly name provided by user
+  _category: string; //category of the resource
+  _service: string; //AWS service for the resource
+  _inputPayload: S3UserInputs | undefined; //S3 options selected by user
+
+  constructor(props: S3InputStateOptions) {
+    this._category = AmplifyCategories.STORAGE;
+    this._service = AmplifySupportedService.S3;
+    this._cliInputsFilePath = props.userInputDataFilename;
+    this._resourceName = props.resourceName;
+
+    // Read cliInputs file if exists
+    try {
+      this._inputPayload = props.inputPayload ?? JSONUtilities.readJson(this._cliInputsFilePath, { throwIfNotExist: true });
+    } catch (e) {
+      throw new Error('migrate project with command : amplify migrate <to be decided>');
+    }
+
+    // validate cli-inputs.json
+    const schemaValidator = new CLIInputSchemaValidator(this._service, this._category, 'S3UserInputs');
+    schemaValidator.validateInput(JSON.stringify(this._inputPayload!));
+  }
+
+  public static getPermissionTypeFromCfnType(s3pPrmissionCfnType: S3CFNPermissionType): S3PermissionType {
+    switch (s3pPrmissionCfnType) {
+      case S3CFNPermissionType.PUT_OBJECT:
+        return S3PermissionType.PUT_OBJECT;
+      case S3CFNPermissionType.GET_OBJECT:
+        return S3PermissionType.GET_OBJECT;
+      case S3CFNPermissionType.DELETE_OBJECT:
+        return S3PermissionType.DELETE_OBJECT;
+      case S3CFNPermissionType.LIST_BUCKET:
+        return S3PermissionType.LIST_BUCKET;
+      default:
+        throw new Error(`Unknown CFN Type: ${s3pPrmissionCfnType}`);
+    }
+  }
+
+  public static getInputPermissionsFromCfnPermissions(selectedGuestPermissions: S3CFNPermissionType[] | undefined) {
+    if (selectedGuestPermissions) {
+      return selectedGuestPermissions.map(S3InputState.getPermissionTypeFromCfnType);
+    } else {
+      return [];
+    }
+  }
+
+  public static cliWalkThroughToCliInputParams(cliInputsFilePath: string, options: S3CLIWalkthroughParams) {
+    const inputProps: S3InputStateOptions = {
+      userInputDataFilename: cliInputsFilePath,
+      resourceName: options.resourceName,
+      inputPayload: {
+        resourceName: options.resourceName,
+        bucketName: options.bucketName,
+        storageAccess: options.storageAccess,
+        selectedGuestPermissions: S3InputState.getInputPermissionsFromCfnPermissions(options.selectedGuestPermissions),
+        selectedAuthenticatedPermissions: S3InputState.getInputPermissionsFromCfnPermissions(options.selectedAuthenticatedPermissions),
+        isTriggerEnabled: options.triggerFunction !== 'NONE' ? true : false, //enable if trigger
+        triggerFunctionName: options.triggerFunction !== 'NONE' ? options.triggerFunction : undefined,
+      },
+    };
+    return inputProps;
+  }
+
+  updateInputPayload(props: S3InputStateOptions) {
+    // Overwrite
+    this._inputPayload = props.inputPayload;
+
+    // validate cli-inputs.json
+    const schemaValidator = new CLIInputSchemaValidator(this._service, this._category, 'S3UserInputs');
+    schemaValidator.validateInput(JSON.stringify(this._inputPayload!));
+  }
+
+  public static getInstance(props: S3InputStateOptions): S3InputState {
+    const projectPath = pathManager.findProjectRoot();
+    if (!S3InputState.s3InputState) {
+      S3InputState.s3InputState = new S3InputState(props);
+    }
+    S3InputState.s3InputState.updateInputPayload(props);
+    return S3InputState.s3InputState;
+  }
+
+  public getCliInputPayload(): S3UserInputs {
+    if (this._inputPayload) {
+      return this._inputPayload;
+    } else {
+      throw new Error('cli-inputs not present. Either add category or migrate project to support extensibility');
+    }
+  }
+
+  public saveCliInputPayload(): void {
+    const backend = pathManager.getBackendDirPath();
+    fs.ensureDirSync(path.join(pathManager.getBackendDirPath(), this._category, this._resourceName));
+    try {
+      JSONUtilities.writeJson(this._cliInputsFilePath, this._inputPayload);
+    } catch (e) {
+      throw new Error(e);
+    }
+  }
+}
diff --git a/packages/amplify-cli-core/src/cliConstants.ts b/packages/amplify-cli-core/src/cliConstants.ts
index e60538dfdac..ca60614aac3 100644
--- a/packages/amplify-cli-core/src/cliConstants.ts
+++ b/packages/amplify-cli-core/src/cliConstants.ts
@@ -26,7 +26,7 @@ export const AmplifySupportedService = {
   COGNITO: 'Cognito',
 };
 
-export const overriddenCategories = [AmplifyCategories.AUTH];
+export const overriddenCategories = [AmplifyCategories.AUTH, AmplifyCategories.STORAGE];
 
 export type IAmplifyResource = {
   category: string;
diff --git a/packages/amplify-cli-core/src/feature-flags/featureFlags.ts b/packages/amplify-cli-core/src/feature-flags/featureFlags.ts
index 8e6655a7b40..9a802f35fa4 100644
--- a/packages/amplify-cli-core/src/feature-flags/featureFlags.ts
+++ b/packages/amplify-cli-core/src/feature-flags/featureFlags.ts
@@ -702,6 +702,12 @@ export class FeatureFlags {
 
     // FF for overrides
     this.registerFlag('overrides', [
+      {
+        name: 'storage',
+        type: 'boolean',
+        defaultValueForExistingProjects: false,
+        defaultValueForNewProjects: true,
+      },
       {
         name: 'auth',
         type: 'boolean',
diff --git a/packages/amplify-cli-core/src/state-manager/pathManager.ts b/packages/amplify-cli-core/src/state-manager/pathManager.ts
index 268aad89753..00a8d9d0716 100644
--- a/packages/amplify-cli-core/src/state-manager/pathManager.ts
+++ b/packages/amplify-cli-core/src/state-manager/pathManager.ts
@@ -53,6 +53,7 @@ export const PathConstants = {
   CLIJsonWithEnvironmentFileName: (env: string) => `cli.${env}.json`,
 
   CfnFileName: (resourceName: string) => `${resourceName}-awscloudformation-template.json`,
+  cliInputsFileName: 'cli-inputs.json',
 };
 
 export class PathManager {
@@ -89,6 +90,16 @@ export class PathManager {
   getBackendDirPath = (projectPath?: string): string =>
     this.constructPath(projectPath, [PathConstants.AmplifyDirName, PathConstants.BackendDirName]);
 
+  getCliInputsPath = (projectPath: string, category: string, resourceName: string): string => {
+    return this.constructPath(projectPath, [
+      PathConstants.AmplifyDirName,
+      PathConstants.BackendDirName,
+      category,
+      resourceName,
+      PathConstants.cliInputsFileName,
+    ]);
+  };
+
   getCurrentCloudBackendDirPath = (projectPath?: string): string =>
     this.constructPath(projectPath, [PathConstants.AmplifyDirName, PathConstants.CurrentCloudBackendDirName]);
 
diff --git a/packages/amplify-cli/amplify-plugin.json b/packages/amplify-cli/amplify-plugin.json
index 2849e512d89..dc90102dda9 100644
--- a/packages/amplify-cli/amplify-plugin.json
+++ b/packages/amplify-cli/amplify-plugin.json
@@ -19,7 +19,8 @@
     "status",
     "uninstall",
     "upgrade",
-    "version"
+    "version",
+    "build-override"
   ],
   "commandAliases": {
     "h": "help",
diff --git a/packages/amplify-cli/package.json b/packages/amplify-cli/package.json
index c892a0c9b4e..22b0edb4790 100644
--- a/packages/amplify-cli/package.json
+++ b/packages/amplify-cli/package.json
@@ -44,7 +44,7 @@
     "amplify-category-interactions": "2.6.5",
     "amplify-category-notifications": "2.19.4",
     "amplify-category-predictions": "2.9.12",
-    "amplify-category-storage": "2.12.9",
+    "@aws-amplify/amplify-category-storage": "1.0.0",
     "amplify-category-xr": "2.8.21",
     "amplify-cli-core": "1.29.0",
     "amplify-cli-logger": "1.1.0",
@@ -211,7 +211,7 @@
       "storage": {
         "name": "storage",
         "type": "category",
-        "packageName": "amplify-category-storage"
+        "packageName": "@aws-amplify/amplify-category-storage"
       },
       "xr": {
         "name": "xr",

From 8c207d16aff7244b72fe30d553e2cebff2ef2e94 Mon Sep 17 00:00:00 2001
From: Kaustav Ghosh <kaustav.ghosh19@gmail.com>
Date: Tue, 5 Oct 2021 15:08:45 -0700
Subject: [PATCH 5/6] chore: ddb walkthrough refactor and override tests
 (#8364)

* chore: overrides ddb and walthrough refactor tests

* chore: address pr comments

Co-authored-by: Ghosh <kaustavg@3c22fb229ff6.ant.amazon.com>
---
 .../src/__tests__/commands/add.test.ts        |  37 +++
 .../src/__tests__/commands/override.test.ts   |  92 +++++++
 .../src/__tests__/commands/remove.test.ts     |  46 ++++
 .../src/__tests__/commands/update.test.ts     |  34 +++
 .../ddb-stack-transform.test.ts.snap          | 190 ++++++++++++++
 .../ddb-stack-transform.test.ts               |  84 ++++++
 .../dynamoDb-walkthrough.test.ts              | 239 +++++++++++++++++
 .../src/commands/storage/override.ts          |  95 +++----
 .../dynamoDb-walkthrough.ts                   |  40 ++-
 .../src/categories/storage.ts                 | 245 ++++++++++--------
 packages/amplify-e2e-tests/Readme.md          |   2 +-
 .../overrides/override-storage-ddb.ts         |   6 +
 packages/amplify-e2e-tests/package.json       |   2 +-
 .../src/__tests__/storage.test.ts             |  77 +++++-
 14 files changed, 999 insertions(+), 190 deletions(-)
 create mode 100644 packages/amplify-category-storage/src/__tests__/commands/add.test.ts
 create mode 100644 packages/amplify-category-storage/src/__tests__/commands/override.test.ts
 create mode 100644 packages/amplify-category-storage/src/__tests__/commands/remove.test.ts
 create mode 100644 packages/amplify-category-storage/src/__tests__/commands/update.test.ts
 create mode 100644 packages/amplify-category-storage/src/__tests__/provider-utils/awscloudformation/cdk-stack-builder/__snapshots__/ddb-stack-transform.test.ts.snap
 create mode 100644 packages/amplify-category-storage/src/__tests__/provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform.test.ts
 create mode 100644 packages/amplify-category-storage/src/__tests__/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.test.ts
 create mode 100644 packages/amplify-e2e-tests/overrides/override-storage-ddb.ts

diff --git a/packages/amplify-category-storage/src/__tests__/commands/add.test.ts b/packages/amplify-category-storage/src/__tests__/commands/add.test.ts
new file mode 100644
index 00000000000..131d6a1d400
--- /dev/null
+++ b/packages/amplify-category-storage/src/__tests__/commands/add.test.ts
@@ -0,0 +1,37 @@
+import { $TSContext, $TSObject } from 'amplify-cli-core';
+import { run } from '../../commands/storage/add';
+import * as providerController from '../../provider-utils/awscloudformation/index';
+
+jest.mock('../../provider-utils/awscloudformation/index');
+jest.mock('amplify-cli-core');
+
+const providerController_mock = providerController as jest.Mocked<typeof providerController>;
+providerController_mock.addResource.mockImplementation = jest.fn().mockImplementation(async () => {
+  return 'mockResourceName';
+});
+
+describe('add ddb command tests', () => {
+  const provider = 'awscloudformation';
+  let mockContext: $TSContext;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockContext = {
+      amplify: {},
+    } as unknown as $TSContext;
+  });
+
+  it('add resource workflow is invoked for DDB', async () => {
+    const service = 'DynamoDB';
+    mockContext.amplify.serviceSelectionPrompt = jest.fn().mockImplementation(async () => {
+      return { service: service, providerName: provider };
+    });
+
+    await run(mockContext);
+
+    expect(providerController_mock.addResource).toHaveBeenCalledWith(mockContext, 'storage', service, {
+      service: service,
+      providerPlugin: provider,
+    });
+  });
+});
diff --git a/packages/amplify-category-storage/src/__tests__/commands/override.test.ts b/packages/amplify-category-storage/src/__tests__/commands/override.test.ts
new file mode 100644
index 00000000000..2d8f9799cfe
--- /dev/null
+++ b/packages/amplify-category-storage/src/__tests__/commands/override.test.ts
@@ -0,0 +1,92 @@
+import { $TSContext, $TSObject, stateManager, generateOverrideSkeleton, pathManager } from 'amplify-cli-core';
+import { run } from '../../commands/storage/override';
+import { printer, prompter } from 'amplify-prompts';
+import path from 'path';
+import { DynamoDBInputState } from '../../provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state';
+
+jest.mock('amplify-cli-core');
+jest.mock('amplify-prompts');
+jest.mock('path');
+jest.mock('../../provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state');
+jest.mock('../../provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform');
+
+const generateOverrideSkeleton_mock = generateOverrideSkeleton as jest.MockedFunction<typeof generateOverrideSkeleton>;
+generateOverrideSkeleton_mock.mockImplementation = jest.fn().mockImplementation(async () => {
+  return 'mockResourceName';
+});
+
+describe('override ddb command tests', () => {
+  let mockContext: $TSContext;
+  let mockAmplifyMeta: $TSObject = {};
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockContext = {
+      amplify: {},
+    } as unknown as $TSContext;
+  });
+
+  it('override ddb when two ddb storage resources present', async () => {
+    mockAmplifyMeta = {
+      storage: {
+        dynamo73399689: {
+          service: 'DynamoDB',
+          providerPlugin: 'awscloudformation',
+        },
+        dynamoefb50875: {
+          service: 'DynamoDB',
+          providerPlugin: 'awscloudformation',
+        },
+      },
+    };
+
+    const destDir = 'mockDir';
+    const srcDir = 'mockSrcDir';
+
+    stateManager.getMeta = jest.fn().mockReturnValue(mockAmplifyMeta);
+    pathManager.getResourceDirectoryPath = jest.fn().mockReturnValue(destDir);
+    path.join = jest.fn().mockReturnValue(srcDir);
+
+    prompter.pick = jest.fn().mockReturnValue('dynamo73399689');
+    jest.spyOn(DynamoDBInputState.prototype, 'cliInputFileExists').mockImplementation(() => true);
+
+    await run(mockContext);
+
+    expect(prompter.pick).toBeCalledTimes(1);
+    expect(generateOverrideSkeleton).toHaveBeenCalledWith(mockContext, srcDir, destDir);
+  });
+
+  it('override ddb when one ddb storage resource present', async () => {
+    mockAmplifyMeta = {
+      storage: {
+        dynamo73399689: {
+          service: 'DynamoDB',
+          providerPlugin: 'awscloudformation',
+        },
+      },
+    };
+
+    const destDir = 'mockDir';
+    const srcDir = 'mockSrcDir';
+
+    stateManager.getMeta = jest.fn().mockReturnValue(mockAmplifyMeta);
+    pathManager.getResourceDirectoryPath = jest.fn().mockReturnValue(destDir);
+    path.join = jest.fn().mockReturnValue(srcDir);
+
+    jest.spyOn(DynamoDBInputState.prototype, 'cliInputFileExists').mockImplementation(() => true);
+
+    await run(mockContext);
+
+    // Prompter should not be called when only one ddb/storage resource present
+    expect(prompter.pick).toBeCalledTimes(0);
+    expect(generateOverrideSkeleton).toHaveBeenCalledWith(mockContext, srcDir, destDir);
+  });
+
+  it('override ddb when no ddb storage resource present', async () => {
+    mockAmplifyMeta = {};
+    stateManager.getMeta = jest.fn().mockReturnValue(mockAmplifyMeta);
+
+    await run(mockContext);
+    expect(printer.error).toHaveBeenCalledWith('No resources to override. You need to add a resource.');
+  });
+});
diff --git a/packages/amplify-category-storage/src/__tests__/commands/remove.test.ts b/packages/amplify-category-storage/src/__tests__/commands/remove.test.ts
new file mode 100644
index 00000000000..d51facdb6c6
--- /dev/null
+++ b/packages/amplify-category-storage/src/__tests__/commands/remove.test.ts
@@ -0,0 +1,46 @@
+import { $TSContext, $TSObject } from 'amplify-cli-core';
+import { run } from '../../commands/storage/remove';
+import * as providerController from '../../provider-utils/awscloudformation/index';
+
+jest.mock('../../provider-utils/awscloudformation/index');
+jest.mock('amplify-cli-core');
+
+const providerController_mock = providerController as jest.Mocked<typeof providerController>;
+providerController_mock.updateResource.mockImplementation = jest.fn().mockImplementation(async () => {
+  return 'mockResourceName';
+});
+
+describe('remove ddb command tests', () => {
+  const provider = 'awscloudformation';
+  let mockContext: $TSContext;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockContext = {
+      amplify: {},
+      parameters: {},
+    } as unknown as $TSContext;
+  });
+
+  it('update resource workflow is invoked for DDB with no params', async () => {
+    mockContext.amplify.removeResource = jest.fn().mockImplementation(async () => {
+      return;
+    });
+
+    await run(mockContext);
+
+    expect(mockContext.amplify.removeResource).toHaveBeenCalledWith(mockContext, 'storage', undefined);
+  });
+
+  it('update resource workflow is invoked for DDB with params as resourceName', async () => {
+    const mockResourceName = 'mockResourceName';
+    mockContext.parameters.first = mockResourceName;
+    mockContext.amplify.removeResource = jest.fn().mockImplementation(async () => {
+      return;
+    });
+
+    await run(mockContext);
+
+    expect(mockContext.amplify.removeResource).toHaveBeenCalledWith(mockContext, 'storage', mockResourceName);
+  });
+});
diff --git a/packages/amplify-category-storage/src/__tests__/commands/update.test.ts b/packages/amplify-category-storage/src/__tests__/commands/update.test.ts
new file mode 100644
index 00000000000..2bc7152c460
--- /dev/null
+++ b/packages/amplify-category-storage/src/__tests__/commands/update.test.ts
@@ -0,0 +1,34 @@
+import { $TSContext, $TSObject } from 'amplify-cli-core';
+import { run } from '../../commands/storage/update';
+import * as providerController from '../../provider-utils/awscloudformation/index';
+
+jest.mock('../../provider-utils/awscloudformation/index');
+jest.mock('amplify-cli-core');
+
+const providerController_mock = providerController as jest.Mocked<typeof providerController>;
+providerController_mock.updateResource.mockImplementation = jest.fn().mockImplementation(async () => {
+  return 'mockResourceName';
+});
+
+describe('update ddb command tests', () => {
+  const provider = 'awscloudformation';
+  let mockContext: $TSContext;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockContext = {
+      amplify: {},
+    } as unknown as $TSContext;
+  });
+
+  it('update resource workflow is invoked for DDB', async () => {
+    const service = 'DynamoDB';
+    mockContext.amplify.serviceSelectionPrompt = jest.fn().mockImplementation(async () => {
+      return { service: service, providerName: provider };
+    });
+
+    await run(mockContext);
+
+    expect(providerController_mock.updateResource).toHaveBeenCalledWith(mockContext, 'storage', service);
+  });
+});
diff --git a/packages/amplify-category-storage/src/__tests__/provider-utils/awscloudformation/cdk-stack-builder/__snapshots__/ddb-stack-transform.test.ts.snap b/packages/amplify-category-storage/src/__tests__/provider-utils/awscloudformation/cdk-stack-builder/__snapshots__/ddb-stack-transform.test.ts.snap
new file mode 100644
index 00000000000..c43cfb4473d
--- /dev/null
+++ b/packages/amplify-category-storage/src/__tests__/provider-utils/awscloudformation/cdk-stack-builder/__snapshots__/ddb-stack-transform.test.ts.snap
@@ -0,0 +1,190 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Test DDB transform generates correct CFN template Generated ddb template with all CLI configurations set with no overrides 1`] = `
+Object {
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Conditions": Object {
+    "ShouldNotCreateEnvResources": Object {
+      "Fn::Equals": Array [
+        Object {
+          "Ref": "env",
+        },
+        "NONE",
+      ],
+    },
+  },
+  "Description": "DDB Resource for AWS Amplify CLI",
+  "Outputs": Object {
+    "Arn": Object {
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "DynamoDBTable",
+          "Arn",
+        ],
+      },
+    },
+    "Name": Object {
+      "Value": Object {
+        "Ref": "DynamoDBTable",
+      },
+    },
+    "PartitionKeyName": Object {
+      "Value": Object {
+        "Ref": "partitionKeyName",
+      },
+    },
+    "PartitionKeyType": Object {
+      "Value": Object {
+        "Ref": "partitionKeyType",
+      },
+    },
+    "Region": Object {
+      "Value": Object {
+        "Ref": "AWS::Region",
+      },
+    },
+    "SortKeyName": Object {
+      "Value": Object {
+        "Ref": "sortKeyName",
+      },
+    },
+    "SortKeyType": Object {
+      "Value": Object {
+        "Ref": "sortKeyType",
+      },
+    },
+    "StreamArn": Object {
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "DynamoDBTable",
+          "StreamArn",
+        ],
+      },
+    },
+  },
+  "Parameters": Object {
+    "env": Object {
+      "Type": "String",
+    },
+    "partitionKeyName": Object {
+      "Type": "String",
+    },
+    "partitionKeyType": Object {
+      "Type": "String",
+    },
+    "sortKeyName": Object {
+      "Type": "String",
+    },
+    "sortKeyType": Object {
+      "Type": "String",
+    },
+    "tableName": Object {
+      "Type": "String",
+    },
+  },
+  "Resources": Object {
+    "DynamoDBTable": Object {
+      "Properties": Object {
+        "AttributeDefinitions": Array [
+          Object {
+            "AttributeName": "id",
+            "AttributeType": "S",
+          },
+          Object {
+            "AttributeName": "name",
+            "AttributeType": "N",
+          },
+          Object {
+            "AttributeName": "col",
+            "AttributeType": "S",
+          },
+        ],
+        "GlobalSecondaryIndexes": Array [
+          Object {
+            "IndexName": "gsiname",
+            "KeySchema": Array [
+              Object {
+                "AttributeName": "name",
+                "KeyType": "HASH",
+              },
+            ],
+            "Projection": Object {
+              "ProjectionType": "ALL",
+            },
+            "ProvisionedThroughput": Object {
+              "ReadCapacityUnits": 5,
+              "WriteCapacityUnits": 5,
+            },
+          },
+          Object {
+            "IndexName": "updategsiname",
+            "KeySchema": Array [
+              Object {
+                "AttributeName": "col",
+                "KeyType": "HASH",
+              },
+            ],
+            "Projection": Object {
+              "ProjectionType": "ALL",
+            },
+            "ProvisionedThroughput": Object {
+              "ReadCapacityUnits": 5,
+              "WriteCapacityUnits": 5,
+            },
+          },
+        ],
+        "KeySchema": Array [
+          Object {
+            "AttributeName": "id",
+            "KeyType": "HASH",
+          },
+          Object {
+            "AttributeName": "name",
+            "KeyType": "RANGE",
+          },
+        ],
+        "ProvisionedThroughput": Object {
+          "ReadCapacityUnits": 5,
+          "WriteCapacityUnits": 5,
+        },
+        "StreamSpecification": Object {
+          "StreamViewType": "NEW_IMAGE",
+        },
+        "TableName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            Object {
+              "Ref": "tableName",
+            },
+            Object {
+              "Fn::Join": Array [
+                "",
+                Array [
+                  Object {
+                    "Ref": "tableName",
+                  },
+                  "-",
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+      },
+      "Type": "AWS::DynamoDB::Table",
+    },
+  },
+}
+`;
+
+exports[`Test DDB transform generates correct CFN template Generated ddb template with all CLI configurations set with no overrides 2`] = `
+Object {
+  "partitionKeyName": "id",
+  "partitionKeyType": "string",
+  "sortKeyName": "name",
+  "sortKeyType": "number",
+  "tableName": "mocktablename",
+}
+`;
diff --git a/packages/amplify-category-storage/src/__tests__/provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform.test.ts b/packages/amplify-category-storage/src/__tests__/provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform.test.ts
new file mode 100644
index 00000000000..2ed25da6c73
--- /dev/null
+++ b/packages/amplify-category-storage/src/__tests__/provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform.test.ts
@@ -0,0 +1,84 @@
+/* These tests, test the tranform and in rurn the cdk builder too which is used within this file */
+
+import { JSONUtilities, buildOverrideDir, pathManager } from 'amplify-cli-core';
+import * as fs from 'fs-extra';
+import { DDBStackTransform } from '../../../../provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform';
+import {
+  DynamoDBCLIInputs,
+  FieldType,
+} from '../../../../provider-utils/awscloudformation/service-walkthrough-types/dynamoDB-user-input-types';
+import { DynamoDBInputState } from '../../../../provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state';
+import path from 'path';
+
+jest.mock('amplify-cli-core', () => ({
+  buildOverrideDir: jest.fn().mockResolvedValue(false),
+  JSONUtilities: {
+    writeJson: jest.fn(),
+    readJson: jest.fn(),
+  },
+  pathManager: {
+    getBackendDirPath: jest.fn().mockReturnValue('mockbackendpath'),
+    getResourceDirectoryPath: jest.fn().mockReturnValue('mockresourcepath'),
+  },
+}));
+jest.mock('fs-extra', () => ({
+  readFileSync: () => '{ "Cognito": { "provider": "aws"}}',
+  existsSync: () => true,
+  ensureDirSync: jest.fn(),
+}));
+
+jest.mock('path', () => ({
+  join: jest.fn().mockReturnValue('mockjoinedpath'),
+  resolve: jest.fn().mockReturnValue('mockjoinedpath'),
+}));
+
+jest.mock('../../../../provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state');
+
+describe('Test DDB transform generates correct CFN template', () => {
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('Generated ddb template with all CLI configurations set with no overrides', async () => {
+    const resourceName = 'mockResource';
+    const cliInputsJSON: DynamoDBCLIInputs = {
+      resourceName: resourceName,
+      tableName: 'mocktablename',
+      partitionKey: {
+        fieldName: 'id',
+        fieldType: FieldType.string,
+      },
+      sortKey: {
+        fieldName: 'name',
+        fieldType: FieldType.number,
+      },
+      gsi: [
+        {
+          name: 'gsiname',
+          partitionKey: {
+            fieldName: 'name',
+            fieldType: FieldType.number,
+          },
+        },
+        {
+          name: 'updategsiname',
+          partitionKey: {
+            fieldName: 'col',
+            fieldType: FieldType.string,
+          },
+        },
+      ],
+      triggerFunctions: [],
+    };
+
+    jest.spyOn(DynamoDBInputState.prototype, 'getCliInputPayload').mockImplementation(() => cliInputsJSON);
+    const ddbTransform = new DDBStackTransform(resourceName);
+    await ddbTransform.transform();
+
+    console.log(ddbTransform._cfn);
+    console.log(ddbTransform._cfnInputParams);
+
+    expect(ddbTransform._cfn).toMatchSnapshot();
+    expect(ddbTransform._cfnInputParams).toMatchSnapshot();
+  });
+});
diff --git a/packages/amplify-category-storage/src/__tests__/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.test.ts b/packages/amplify-category-storage/src/__tests__/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.test.ts
new file mode 100644
index 00000000000..d6af9e7020c
--- /dev/null
+++ b/packages/amplify-category-storage/src/__tests__/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.test.ts
@@ -0,0 +1,239 @@
+import { $TSContext, stateManager } from 'amplify-cli-core';
+import { prompter } from 'amplify-prompts';
+import { DynamoDBInputState } from '../../../../provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state';
+import { DDBStackTransform } from '../../../../provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform';
+import { addWalkthrough, updateWalkthrough } from '../../../../provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough';
+import {
+  DynamoDBCLIInputs,
+  FieldType,
+} from '../../../../provider-utils/awscloudformation/service-walkthrough-types/dynamoDB-user-input-types';
+
+jest.mock('amplify-cli-core');
+jest.mock('amplify-prompts');
+jest.mock('../../../../provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state');
+jest.mock('../../../../provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform');
+
+describe('add ddb walkthrough tests', () => {
+  let mockContext: $TSContext;
+
+  beforeEach(() => {
+    mockContext = {
+      amplify: {
+        getProjectDetails: () => {
+          return {
+            projectConfig: {
+              projectName: 'mockProject',
+            },
+          };
+        },
+      },
+    } as unknown as $TSContext;
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('addWalkthrough() test', async () => {
+    jest.spyOn(DynamoDBInputState.prototype, 'saveCliInputPayload').mockImplementation(() => true);
+    jest.spyOn(DDBStackTransform.prototype, 'transform').mockImplementation(() => Promise.resolve());
+
+    const expectedCLIInputsJSON: DynamoDBCLIInputs = {
+      resourceName: 'mockresourcename',
+      tableName: 'mocktablename',
+      partitionKey: {
+        fieldName: 'id',
+        fieldType: FieldType.string,
+      },
+      sortKey: {
+        fieldName: 'name',
+        fieldType: FieldType.number,
+      },
+      gsi: [
+        {
+          name: 'gsiname',
+          partitionKey: {
+            fieldName: 'name',
+            fieldType: FieldType.number,
+          },
+        },
+        {
+          name: 'secondgsiname',
+          partitionKey: {
+            fieldName: 'id',
+            fieldType: FieldType.string,
+          },
+          sortKey: {
+            fieldName: 'name',
+            fieldType: FieldType.number,
+          },
+        },
+      ],
+      triggerFunctions: [],
+    };
+
+    prompter.input = jest
+      .fn()
+      .mockReturnValueOnce('mockresourcename') // Provide a friendly name
+      .mockResolvedValueOnce('mocktablename') // Provide table name
+      .mockResolvedValueOnce('id') // What would you like to name this column
+      .mockResolvedValueOnce('name') // What would you like to name this column
+      .mockResolvedValueOnce('gsiname') // Provide the GSI name
+      .mockResolvedValueOnce('secondgsiname'); // Provide the GSI name
+
+    prompter.pick = jest
+      .fn()
+      .mockReturnValueOnce('string') // Choose the data type
+      .mockReturnValueOnce('number') // Choose the data type
+      .mockReturnValueOnce('id') // Choose partition key for the table
+      .mockReturnValueOnce('name') // Choose sort key for the table
+      .mockReturnValueOnce('name') // Choose partition key for the GSI
+      .mockReturnValueOnce('id') // Choose partition key for the GSI
+      .mockReturnValueOnce('name'); // Choose sort key for the GSI
+
+    prompter.yesOrNo = jest
+      .fn()
+      .mockReturnValueOnce(true) // Would you like to add another column
+      .mockReturnValueOnce(false) // Would you like to add another column
+      .mockReturnValueOnce(true) // Do you want to add a sort key to your table?
+      .mockReturnValueOnce(true) // Do you want to add global secondary indexes to your table?
+      .mockReturnValueOnce(false) // Do you want to add a sort key to your global secondary index?
+      .mockReturnValueOnce(true) // Do you want to add more global secondary indexes to your table?
+      .mockReturnValueOnce(true) // Do you want to add a sort key to your global secondary index?
+      .mockReturnValueOnce(false); // Do you want to add more global secondary indexes to your table?
+
+    prompter.confirmContinue = jest.fn().mockReturnValueOnce(false); // Do you want to add a Lambda Trigger for your Table?
+
+    const returnedResourcename = await addWalkthrough(mockContext, 'dynamoDb-defaults');
+
+    expect(returnedResourcename).toEqual('mockresourcename');
+    expect(DynamoDBInputState.prototype.saveCliInputPayload).toHaveBeenCalledWith(expectedCLIInputsJSON);
+  });
+});
+
+describe('update ddb walkthrough tests', () => {
+  let mockContext: $TSContext;
+
+  beforeEach(() => {
+    jest.mock('amplify-prompts');
+    mockContext = {
+      amplify: {
+        getProjectDetails: () => {
+          return {
+            projectConfig: {
+              projectName: 'mockProject',
+            },
+          };
+        },
+      },
+    } as unknown as $TSContext;
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('updateWalkthrough() test to add gsi', async () => {
+    let mockAmplifyMeta = {
+      storage: {
+        mockresourcename: {
+          service: 'DynamoDB',
+          providerPlugin: 'awscloudformation',
+        },
+        dynamoefb50875: {
+          service: 'DynamoDB',
+          providerPlugin: 'awscloudformation',
+        },
+      },
+    };
+
+    stateManager.getMeta = jest.fn().mockReturnValue(mockAmplifyMeta);
+
+    const currentCLIInputsJSON: DynamoDBCLIInputs = {
+      resourceName: 'mockresourcename',
+      tableName: 'mocktablename',
+      partitionKey: {
+        fieldName: 'id',
+        fieldType: FieldType.string,
+      },
+      sortKey: {
+        fieldName: 'name',
+        fieldType: FieldType.number,
+      },
+      gsi: [
+        {
+          name: 'gsiname',
+          partitionKey: {
+            fieldName: 'name',
+            fieldType: FieldType.number,
+          },
+        },
+      ],
+      triggerFunctions: [],
+    };
+
+    jest.spyOn(DynamoDBInputState.prototype, 'getCliInputPayload').mockImplementation(() => currentCLIInputsJSON);
+
+    jest.spyOn(DynamoDBInputState.prototype, 'saveCliInputPayload').mockImplementation(() => true);
+    jest.spyOn(DynamoDBInputState.prototype, 'cliInputFileExists').mockImplementation(() => true);
+    jest.spyOn(DDBStackTransform.prototype, 'transform').mockImplementation(() => Promise.resolve());
+
+    prompter.input = jest
+      .fn()
+      .mockResolvedValueOnce('col') // What would you like to name this column
+      .mockResolvedValueOnce('updategsiname'); // Provide the GSI name
+
+    prompter.pick = jest
+      .fn()
+      .mockReturnValueOnce('mockresourcename') // Specify the resource that you would want to update
+      .mockReturnValueOnce('string') // Choose the data type
+      .mockReturnValueOnce('col') // Choose partition key for the GSI
+      .mockReturnValueOnce('name'); // Choose sort key for the GSI
+
+    prompter.yesOrNo = jest
+      .fn()
+      .mockReturnValueOnce(true) // Would you like to add another column
+      .mockReturnValueOnce(false) // Would you like to add another column
+      .mockReturnValueOnce(true) // Do you want to keep existing global seconday indexes created on your table?
+      .mockReturnValueOnce(true) // Do you want to add global secondary indexes to your table?
+      .mockReturnValueOnce(false) // Do you want to add a sort key to your global secondary index
+      .mockReturnValueOnce(false); // Do you want to add more global secondary indexes to your table?
+
+    prompter.confirmContinue = jest.fn().mockReturnValueOnce(false); // Do you want to add a Lambda Trigger for your Table?
+
+    const returnedCLIInputs = await updateWalkthrough(mockContext);
+
+    const expectedCLIInputsJSON: DynamoDBCLIInputs = {
+      resourceName: 'mockresourcename',
+      tableName: 'mocktablename',
+      partitionKey: {
+        fieldName: 'id',
+        fieldType: FieldType.string,
+      },
+      sortKey: {
+        fieldName: 'name',
+        fieldType: FieldType.number,
+      },
+      gsi: [
+        {
+          name: 'gsiname',
+          partitionKey: {
+            fieldName: 'name',
+            fieldType: FieldType.number,
+          },
+        },
+        {
+          name: 'updategsiname',
+          partitionKey: {
+            fieldName: 'col',
+            fieldType: FieldType.string,
+          },
+        },
+      ],
+      triggerFunctions: [],
+    };
+
+    expect(returnedCLIInputs).toEqual(expectedCLIInputsJSON);
+    expect(DynamoDBInputState.prototype.saveCliInputPayload).toHaveBeenCalledWith(expectedCLIInputsJSON);
+  });
+});
diff --git a/packages/amplify-category-storage/src/commands/storage/override.ts b/packages/amplify-category-storage/src/commands/storage/override.ts
index 4b56910d6a1..02371347487 100644
--- a/packages/amplify-category-storage/src/commands/storage/override.ts
+++ b/packages/amplify-category-storage/src/commands/storage/override.ts
@@ -2,10 +2,8 @@
     entry code for amplify override root
 */
 
-import { generateOverrideSkeleton, $TSContext, FeatureFlags, stateManager, pathManager } from 'amplify-cli-core';
-import { printer } from 'amplify-prompts';
-import * as fs from 'fs-extra';
-import inquirer from 'inquirer';
+import { generateOverrideSkeleton, $TSContext, stateManager, pathManager } from 'amplify-cli-core';
+import { printer, prompter } from 'amplify-prompts';
 import { DynamoDBInputState } from '../../provider-utils/awscloudformation/service-walkthroughs/dynamoDB-input-state';
 import { DDBStackTransform } from '../../provider-utils/awscloudformation/cdk-stack-builder/ddb-stack-transform';
 import * as path from 'path';
@@ -14,70 +12,55 @@ import { categoryName } from '../../constants';
 export const name = 'override';
 
 export const run = async (context: $TSContext) => {
-  if (FeatureFlags.getBoolean('overrides.project')) {
-    const { amplify } = context;
-    const amplifyMeta = stateManager.getMeta();
+  const amplifyMeta = stateManager.getMeta();
 
-    const storageResources: string[] = [];
+  const storageResources: string[] = [];
 
+  if (amplifyMeta[categoryName]) {
     Object.keys(amplifyMeta[categoryName]).forEach(resourceName => {
       storageResources.push(resourceName);
     });
+  }
 
-    if (storageResources.length === 0) {
-      const errMessage = 'No resources to override. You need to add a resource.';
-      printer.error(errMessage);
-      return;
-    }
+  if (storageResources.length === 0) {
+    const errMessage = 'No resources to override. You need to add a resource.';
+    printer.error(errMessage);
+    return;
+  }
 
-    let selectedResourceName: string = storageResources[0];
+  let selectedResourceName: string = storageResources[0];
 
-    if (storageResources.length > 1) {
-      const resourceAnswer = await inquirer.prompt({
-        type: 'list',
-        name: 'resource',
-        message: 'Which resource would you like to add overrides for?',
-        choices: storageResources,
-      });
-      selectedResourceName = resourceAnswer.resource;
-    }
+  if (storageResources.length > 1) {
+    selectedResourceName = await prompter.pick('Which resource would you like to add overrides for?', storageResources);
+  }
 
-    const destPath = pathManager.getResourceDirectoryPath(undefined, categoryName, selectedResourceName);
-    fs.ensureDirSync(destPath);
+  const destPath = pathManager.getResourceDirectoryPath(undefined, categoryName, selectedResourceName);
 
-    const srcPath = path.join(
-      __dirname,
-      '..',
-      '..',
-      '..',
-      'resources',
-      'overrides-resource',
-      amplifyMeta[categoryName][selectedResourceName].service,
-    );
+  const srcPath = path.join(
+    __dirname,
+    '..',
+    '..',
+    '..',
+    'resources',
+    'overrides-resource',
+    amplifyMeta[categoryName][selectedResourceName].service,
+  );
 
-    // Make sure to migrate first
-    if (amplifyMeta[categoryName][selectedResourceName].service === 'DynamoDB') {
-      const resourceInputState = new DynamoDBInputState(selectedResourceName);
-      if (!resourceInputState.cliInputFileExists()) {
-        if (await amplify.confirmPrompt('File migration required to continue. Do you want to continue?', true)) {
-          resourceInputState.migrate();
-          const stackGenerator = new DDBStackTransform(selectedResourceName);
-          stackGenerator.transform();
-        } else {
-          return;
-        }
+  // Make sure to migrate first
+  if (amplifyMeta[categoryName][selectedResourceName].service === 'DynamoDB') {
+    const resourceInputState = new DynamoDBInputState(selectedResourceName);
+    if (!resourceInputState.cliInputFileExists()) {
+      if (await prompter.yesOrNo('File migration required to continue. Do you want to continue?', true)) {
+        resourceInputState.migrate();
+        const stackGenerator = new DDBStackTransform(selectedResourceName);
+        stackGenerator.transform();
+      } else {
+        return;
       }
-    } else if (amplifyMeta[categoryName][selectedResourceName].service === 'S3') {
-      // S3 migration logic goes in here
     }
-
-    await generateOverrideSkeleton(context, srcPath, destPath);
-  } else {
-    printer.info('Storage overrides is currently not turned on. In amplify/cli.json file please include the following:');
-    printer.info(`{
-      override: {
-         storage: true
-      }
-    }`);
+  } else if (amplifyMeta[categoryName][selectedResourceName].service === 'S3') {
+    // S3 migration logic goes in here
   }
+
+  await generateOverrideSkeleton(context, srcPath, destPath);
 };
diff --git a/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.ts b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.ts
index 2934af82a24..80befacebd8 100644
--- a/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.ts
+++ b/packages/amplify-category-storage/src/provider-utils/awscloudformation/service-walkthroughs/dynamoDb-walkthrough.ts
@@ -2,7 +2,7 @@ import * as path from 'path';
 import * as fs from 'fs-extra';
 import uuid from 'uuid';
 import { alphanumeric, printer, prompter, Validator } from 'amplify-prompts';
-import { $TSContext, AmplifyCategories, ResourceDoesNotExistError, exitOnNextTick } from 'amplify-cli-core';
+import { $TSContext, AmplifyCategories, ResourceDoesNotExistError, exitOnNextTick, stateManager } from 'amplify-cli-core';
 import { DynamoDBInputState } from './dynamoDB-input-state';
 import {
   DynamoDBAttributeDefType,
@@ -11,19 +11,20 @@ import {
   DynamoDBCLIInputsKeyType,
 } from '../service-walkthrough-types/dynamoDB-user-input-types';
 import { DDBStackTransform } from '../cdk-stack-builder/ddb-stack-transform';
+import { ConfigSnapshotDeliveryProperties } from 'cloudform-types/types/config/deliveryChannel';
 
 // keep in sync with ServiceName in amplify-AmplifyCategories.STORAGE-function, but probably it will not change
 const FunctionServiceNameLambdaFunction = 'Lambda';
 const serviceName = 'DynamoDB';
 
-async function addWalkthrough(context: $TSContext, defaultValuesFilename: string) {
+export async function addWalkthrough(context: $TSContext, defaultValuesFilename: string) {
   printer.blankLine();
   printer.info('Welcome to the NoSQL DynamoDB database wizard');
   printer.info('This wizard asks you a series of questions to help determine how to set up your NoSQL database table.');
   printer.blankLine();
 
   const defaultValuesSrc = path.join(__dirname, '..', 'default-values', defaultValuesFilename);
-  const { getAllDefaults } = require(defaultValuesSrc);
+  const { getAllDefaults } = await import(defaultValuesSrc);
   const { amplify } = context;
   const defaultValues = getAllDefaults(amplify.getProjectDetails());
 
@@ -55,11 +56,8 @@ async function addWalkthrough(context: $TSContext, defaultValuesFilename: string
   return cliInputs.resourceName;
 }
 
-async function updateWalkthrough(context: $TSContext) {
-  // const resourceName = resourceAlreadyExists(context);
-  const { amplify } = context;
-  const { amplifyMeta } = amplify.getProjectDetails();
-
+export async function updateWalkthrough(context: $TSContext) {
+  const amplifyMeta = stateManager.getMeta();
   const dynamoDbResources: any = {};
 
   Object.keys(amplifyMeta[AmplifyCategories.STORAGE]).forEach(resourceName => {
@@ -232,7 +230,7 @@ async function askGSIQuestion(
     gsiList = existingGSIList;
   }
 
-  if (await prompter.confirmContinue('Do you want to add global secondary indexes to your table?')) {
+  if (await prompter.yesOrNo('Do you want to add global secondary indexes to your table?', true)) {
     let continuewithGSIQuestions = true;
 
     while (continuewithGSIQuestions) {
@@ -264,12 +262,11 @@ async function askGSIQuestion(
         const sortKeyOptions = indexableAttributeList.filter((att: string) => att !== gsiPartitionKeyName);
 
         if (sortKeyOptions.length > 0) {
-          if (await prompter.confirmContinue('Do you want to add a sort key to your global secondary index?')) {
+          if (await prompter.yesOrNo('Do you want to add a sort key to your global secondary index?', true)) {
             const gsiSortKeyName = await prompter.pick('Choose sort key for the GSI', [...new Set(sortKeyOptions)]);
             const gsiSortKeyIndex = attributeDefinitions.findIndex(
               (attr: DynamoDBAttributeDefType) => attr.AttributeName === gsiSortKeyName,
             );
-
             gsiItem.sortKey = {
               fieldName: gsiSortKeyName,
               fieldType: attributeDefinitions[gsiSortKeyIndex].AttributeType,
@@ -278,7 +275,7 @@ async function askGSIQuestion(
         }
 
         gsiList.push(gsiItem);
-        continuewithGSIQuestions = await prompter.confirmContinue('Do you want to add more global secondary indexes to your table?');
+        continuewithGSIQuestions = await prompter.yesOrNo('Do you want to add more global secondary indexes to your table?', true);
       } else {
         printer.error('You do not have any other attributes remaining to configure');
         break;
@@ -293,7 +290,7 @@ async function askSortKeyQuestion(
   attributeDefinitions: DynamoDBAttributeDefType[],
   partitionKeyFieldName: string,
 ): Promise<undefined | DynamoDBCLIInputsKeyType> {
-  if (await prompter.confirmContinue('Do you want to add a sort key to your table?')) {
+  if (await prompter.yesOrNo('Do you want to add a sort key to your table?', true)) {
     // Ask for sort key
     if (attributeDefinitions.length > 1) {
       const sortKeyName = await prompter.pick(
@@ -369,7 +366,7 @@ async function askAttributeListQuestion(existingAttributeDefinitions?: DynamoDBC
   if (existingAttributes.length > 0) {
     attributeAnswers = existingAttributes;
     indexableAttributeList = attributeAnswers.map((attr: DynamoDBAttributeDefType) => attr.AttributeName);
-    continueAttributeQuestion = await prompter.confirmContinue('Would you like to add another column?');
+    continueAttributeQuestion = await prompter.yesOrNo('Would you like to add another column?', true);
   }
 
   while (continueAttributeQuestion) {
@@ -400,7 +397,7 @@ async function askAttributeListQuestion(existingAttributeDefinitions?: DynamoDBC
       indexableAttributeList.push(attributeName);
     }
 
-    continueAttributeQuestion = await prompter.confirmContinue('Would you like to add another column?');
+    continueAttributeQuestion = await prompter.yesOrNo('Would you like to add another column?', true);
   }
 
   return { attributeAnswers, indexableAttributeList };
@@ -412,7 +409,7 @@ async function askTableNameQuestion(defaultValues: any, resourceName: string) {
     (input: string) =>
       /^[a-zA-Z0-9._-]+$/.test(input) ? true : message;
 
-  const tableName = await prompter.input('Provide table name:', {
+  const tableName = await prompter.input('Provide table name', {
     validate: tableNameValidator('You can use the following characters: a-z A-Z 0-9 . - _'),
     initial: resourceName || defaultValues['tableName'],
   });
@@ -421,13 +418,10 @@ async function askTableNameQuestion(defaultValues: any, resourceName: string) {
 }
 
 async function askResourceNameQuestion(defaultValues: any): Promise<string> {
-  const resourceName = await prompter.input(
-    'Provide a friendly name for your resource that will be used to label this category in the project',
-    {
-      validate: alphanumeric(),
-      initial: defaultValues['resourceName'],
-    },
-  );
+  const resourceName = await prompter.input('Provide a friendly name', {
+    validate: alphanumeric(),
+    initial: defaultValues['resourceName'],
+  });
 
   return resourceName;
 }
diff --git a/packages/amplify-e2e-core/src/categories/storage.ts b/packages/amplify-e2e-core/src/categories/storage.ts
index a5f111caf4b..6adad6021d2 100644
--- a/packages/amplify-e2e-core/src/categories/storage.ts
+++ b/packages/amplify-e2e-core/src/categories/storage.ts
@@ -17,17 +17,23 @@ export function addSimpleDDB(cwd: string, settings: any): Promise<void> {
     spawn(getCLIPath(), ['add', 'storage'], { cwd, stripColors: true })
       .wait('Please select from one of the below mentioned services')
       .sendLine(KEY_DOWN_ARROW)
-      .wait('Please provide a friendly name for your resource')
-      .sendLine(settings.name || '')
-      .wait('Please provide table name')
+      .wait('Provide a friendly name')
+      .sendLine(settings.name || '\r')
+      .wait('Provide table name')
       .sendCarriageReturn()
       .wait('What would you like to name this column')
       .sendLine('id')
-      .wait('Please choose the data type')
+      .wait('Choose the data type')
+      .sendCarriageReturn()
+      .wait('Would you like to add another column')
+      .sendLine('y')
+      .wait('What would you like to name this column')
+      .sendLine('col2')
+      .wait('Choose the data type')
       .sendCarriageReturn()
       .wait('Would you like to add another column')
       .sendLine('n')
-      .wait('Please choose partition key for the table')
+      .wait('Choose partition key for the table')
       .sendCarriageReturn()
       .wait('Do you want to add a sort key to your table')
       .sendLine('n')
@@ -51,7 +57,7 @@ export function addDDBWithTrigger(cwd: string, settings: { ddbResourceName?: str
     const chain = spawn(getCLIPath(), ['add', 'storage'], { cwd, stripColors: true })
       .wait('Please select from one of the below mentioned services')
       .sendLine(KEY_DOWN_ARROW)
-      .wait('Please provide a friendly name for your resource');
+      .wait('Provide a friendly name');
     if (settings.ddbResourceName) {
       chain.sendLine(settings.ddbResourceName);
     } else {
@@ -59,15 +65,21 @@ export function addDDBWithTrigger(cwd: string, settings: { ddbResourceName?: str
     }
     chain
       .sendCarriageReturn()
-      .wait('Please provide table name')
+      .wait('Provide table name')
       .sendCarriageReturn()
       .wait('What would you like to name this column')
       .sendLine('id')
-      .wait('Please choose the data type')
+      .wait('Choose the data type')
+      .sendCarriageReturn()
+      .wait('Would you like to add another column')
+      .sendLine('y')
+      .wait('What would you like to name this column')
+      .sendLine('col2')
+      .wait('Choose the data type')
       .sendCarriageReturn()
       .wait('Would you like to add another column')
       .sendLine('n')
-      .wait('Please choose partition key for the table')
+      .wait('Choose partition key for the table')
       .sendCarriageReturn()
       .wait('Do you want to add a sort key to your table')
       .sendLine('n')
@@ -107,8 +119,6 @@ export function updateDDBWithTrigger(cwd: string, settings: any): Promise<void>
       .sendLine(KEY_DOWN_ARROW)
       .wait('Do you want to edit the local')
       .sendLine('n')
-      .wait('overwrite')
-      .sendLine('y')
       .sendEof()
       .run((err: Error) => {
         if (!err) {
@@ -132,15 +142,17 @@ export function updateSimpleDDBwithGSI(cwd: string, settings: any): Promise<void
       .sendLine('y')
       .wait('What would you like to name this column')
       .sendLine('gsi-col2')
-      .wait('Please choose the data type')
+      .wait('Choose the data type')
       .sendCarriageReturn()
       .wait('Would you like to add another column')
       .sendLine('n')
+      .wait('Do you want to keep existing global seconday indexes created on your table?')
+      .sendLine('y')
       .wait('Do you want to add global secondary indexes to your table?')
       .sendLine('y')
-      .wait('Please provide the GSI name')
+      .wait('Provide the GSI name')
       .sendLine('gsi2')
-      .wait('Please choose partition key for the GSI')
+      .wait('Choose partition key for the GSI')
       .sendKeyDown()
       .sendKeyDown()
       .sendCarriageReturn()
@@ -148,12 +160,8 @@ export function updateSimpleDDBwithGSI(cwd: string, settings: any): Promise<void
       .sendLine('n')
       .wait('Do you want to add more global secondary indexes to your table?')
       .sendLine('n')
-      .wait('Do you want to keep existing global seconday indexes created on your table?')
-      .sendLine('y')
       .wait('Do you want to add a Lambda Trigger for your Table?')
       .sendLine('n')
-      .wait('overwrite')
-      .sendLine('y')
       .sendEof()
       .run((err: Error) => {
         if (!err) {
@@ -171,31 +179,31 @@ export function addSimpleDDBwithGSI(cwd: string, settings: any): Promise<void> {
       .wait('Please select from one of the below mentioned services')
       .send(KEY_DOWN_ARROW)
       .sendCarriageReturn()
-      .wait('Please provide a friendly name for your resource')
+      .wait('Provide a friendly name')
       .sendCarriageReturn()
-      .wait('Please provide table name')
+      .wait('Provide table name')
       .sendCarriageReturn()
       .wait('What would you like to name this column')
       .sendLine('id')
-      .wait('Please choose the data type')
+      .wait('Choose the data type')
       .sendCarriageReturn()
       .wait('Would you like to add another column')
       .sendLine('y')
       .wait('What would you like to name this column')
       .sendLine('gsi-col1')
-      .wait('Please choose the data type')
+      .wait('Choose the data type')
       .sendCarriageReturn()
       .wait('Would you like to add another column')
       .sendLine('n')
-      .wait('Please choose partition key for the table')
+      .wait('Choose partition key for the table')
       .sendCarriageReturn()
       .wait('Do you want to add a sort key to your table')
       .sendLine('n')
       .wait('Do you want to add global secondary indexes to your table?')
       .sendLine('y')
-      .wait('Please provide the GSI name')
+      .wait('Provide the GSI name')
       .sendLine('gsi1')
-      .wait('Please choose partition key for the GSI')
+      .wait('Choose partition key for the GSI')
       .send(KEY_DOWN_ARROW)
       .sendCarriageReturn()
       .wait('Do you want to add a sort key to your global secondary index?')
@@ -215,6 +223,115 @@ export function addSimpleDDBwithGSI(cwd: string, settings: any): Promise<void> {
   });
 }
 
+export function overrideDDB(cwd: string, settings: {}) {
+  return new Promise((resolve, reject) => {
+    const args = ['override', 'storage'];
+
+    spawn(getCLIPath(), args, { cwd, stripColors: true })
+      .wait('Do you want to edit override.ts file now?')
+      .sendConfirmNo()
+      .sendEof()
+      .run((err: Error) => {
+        if (!err) {
+          resolve({});
+        } else {
+          reject(err);
+        }
+      });
+  });
+}
+
+export function buildOverrideStorage(cwd: string, settings: {}) {
+  return new Promise((resolve, reject) => {
+    // Add 'storage' as a category param once implemented
+    const args = ['build-override'];
+
+    spawn(getCLIPath(), args, { cwd, stripColors: true })
+      .sendEof()
+      .run((err: Error) => {
+        if (!err) {
+          resolve({});
+        } else {
+          reject(err);
+        }
+      });
+  });
+}
+
+export function addDynamoDBWithGSIWithSettings(projectDir: string, settings: AddDynamoDBSettings): Promise<void> {
+  return new Promise((resolve, reject) => {
+    let chain = spawn(getCLIPath(), ['add', 'storage'], { cwd: projectDir, stripColors: true });
+
+    singleSelect(chain.wait('Please select from one of the below mentioned services:'), 'NoSQL Database', [
+      'Content (Images, audio, video, etc.)',
+      'NoSQL Database',
+    ]);
+
+    const addColumn = (name, type) => {
+      chain.wait('What would you like to name this column').sendLine(name);
+
+      singleSelect(chain.wait('Choose the data type'), type, ['string', 'number', 'binary', 'boolean', 'list', 'map', 'null']);
+    };
+
+    const addAnotherColumn = () => {
+      chain.wait('Would you like to add another column').sendConfirmYes();
+    };
+
+    chain.wait('Provide a friendly name').sendLine(settings.resourceName).wait('Provide table name').sendLine(settings.tableName);
+
+    addColumn('pk', 'string');
+    addAnotherColumn();
+
+    addColumn('sk', 'string');
+    addAnotherColumn();
+
+    addColumn('gsi-pk', 'string');
+    addAnotherColumn();
+
+    addColumn('gsi-sk', 'string');
+    addAnotherColumn();
+
+    addColumn('title', 'string');
+    addAnotherColumn();
+
+    addColumn('description', 'string');
+
+    chain.wait('Would you like to add another column').sendConfirmNo();
+
+    singleSelect(chain.wait('Choose the data type'), 'pk', ['pk', 'sk', 'gsi-pk', 'gsi-sk', 'title', 'description']);
+
+    chain.wait('Do you want to add a sort key to your table').sendConfirmYes();
+
+    singleSelect(chain.wait('Choose sort key for the table'), 'sk', ['sk', 'gsi-pk', 'gsi-sk', 'title', 'description']);
+
+    chain
+      .wait('Do you want to add global secondary indexes to your table?')
+      .sendConfirmYes()
+      .wait('Provide the GSI name')
+      .sendLine(settings.gsiName);
+
+    singleSelect(chain.wait('Choose partition key for the GSI'), 'gsi-pk', ['sk', 'gsi-pk', 'gsi-sk', 'title', 'description']);
+
+    chain.wait('Do you want to add a sort key to your global secondary index').sendConfirmYes();
+
+    singleSelect(chain.wait('Choose sort key for the GSI'), 'gsi-sk', ['sk', 'gsi-sk', 'title', 'description']);
+
+    chain
+      .wait('Do you want to add more global secondary indexes to your table')
+      .sendConfirmNo()
+      .wait('Do you want to add a Lambda Trigger for your Table')
+      .sendConfirmNo()
+      .sendEof()
+      .run((err: Error) => {
+        if (!err) {
+          resolve();
+        } else {
+          reject(err);
+        }
+      });
+  });
+}
+
 export function addS3(cwd: string, settings: any): Promise<void> {
   return new Promise((resolve, reject) => {
     spawn(getCLIPath(), ['add', 'storage'], { cwd, stripColors: true })
@@ -493,81 +610,3 @@ export function addS3StorageWithSettings(projectDir: string, settings: AddStorag
     });
   });
 }
-
-export function addDynamoDBWithGSIWithSettings(projectDir: string, settings: AddDynamoDBSettings): Promise<void> {
-  return new Promise((resolve, reject) => {
-    let chain = spawn(getCLIPath(), ['add', 'storage'], { cwd: projectDir, stripColors: true });
-
-    singleSelect(chain.wait('Please select from one of the below mentioned services:'), 'NoSQL Database', [
-      'Content (Images, audio, video, etc.)',
-      'NoSQL Database',
-    ]);
-
-    const addColumn = (name, type) => {
-      chain.wait('What would you like to name this column').sendLine(name);
-
-      singleSelect(chain.wait('Please choose the data type:'), type, ['string', 'number', 'binary', 'boolean', 'list', 'map', 'null']);
-    };
-
-    const addAnotherColumn = () => {
-      chain.wait('Would you like to add another column').sendConfirmYes();
-    };
-
-    chain
-      .wait('Please provide a friendly name for your resource')
-      .sendLine(settings.resourceName)
-      .wait('Please provide table name')
-      .sendLine(settings.tableName);
-
-    addColumn('pk', 'string');
-    addAnotherColumn();
-
-    addColumn('sk', 'string');
-    addAnotherColumn();
-
-    addColumn('gsi-pk', 'string');
-    addAnotherColumn();
-
-    addColumn('gsi-sk', 'string');
-    addAnotherColumn();
-
-    addColumn('title', 'string');
-    addAnotherColumn();
-
-    addColumn('description', 'string');
-
-    chain.wait('Would you like to add another column').sendConfirmNo();
-
-    singleSelect(chain.wait('Please choose partition key for the table'), 'pk', ['pk', 'sk', 'gsi-pk', 'gsi-sk', 'title', 'description']);
-
-    chain.wait('Do you want to add a sort key to your table').sendConfirmYes();
-
-    singleSelect(chain.wait('Please choose sort key for the table'), 'sk', ['sk', 'gsi-pk', 'gsi-sk', 'title', 'description']);
-
-    chain
-      .wait('Do you want to add global secondary indexes to your table?')
-      .sendConfirmYes()
-      .wait('Please provide the GSI name')
-      .sendLine(settings.gsiName);
-
-    singleSelect(chain.wait('Please choose partition key for the GSI'), 'gsi-pk', ['sk', 'gsi-pk', 'gsi-sk', 'title', 'description']);
-
-    chain.wait('Do you want to add a sort key to your global secondary index').sendConfirmYes();
-
-    singleSelect(chain.wait('Please choose sort key for the GSI'), 'gsi-sk', ['sk', 'gsi-sk', 'title', 'description']);
-
-    chain
-      .wait('Do you want to add more global secondary indexes to your table')
-      .sendConfirmNo()
-      .wait('Do you want to add a Lambda Trigger for your Table')
-      .sendConfirmNo()
-      .sendEof()
-      .run((err: Error) => {
-        if (!err) {
-          resolve();
-        } else {
-          reject(err);
-        }
-      });
-  });
-}
diff --git a/packages/amplify-e2e-tests/Readme.md b/packages/amplify-e2e-tests/Readme.md
index 9335c8cb261..77e5daccbbf 100644
--- a/packages/amplify-e2e-tests/Readme.md
+++ b/packages/amplify-e2e-tests/Readme.md
@@ -19,7 +19,7 @@ You can run a single test while adding a new test by running
 
 ```bash
 cd <amplif-cli-root>/packages/amplify-e2e-tests/
-npm run e2e __tests__/init.test.ts
+npm run e2e src/__tests__/init.test.ts
 ```
 
 ## Writing a new integration test
diff --git a/packages/amplify-e2e-tests/overrides/override-storage-ddb.ts b/packages/amplify-e2e-tests/overrides/override-storage-ddb.ts
new file mode 100644
index 00000000000..d80e8db9bda
--- /dev/null
+++ b/packages/amplify-e2e-tests/overrides/override-storage-ddb.ts
@@ -0,0 +1,6 @@
+export function overrideProps(props: any) {
+  props.dynamoDBTable.streamSpecification = {
+    streamViewType: 'NEW_AND_OLD_IMAGES',
+  };
+  return props;
+}
diff --git a/packages/amplify-e2e-tests/package.json b/packages/amplify-e2e-tests/package.json
index cd9917f05c9..5a6dbfb8599 100644
--- a/packages/amplify-e2e-tests/package.json
+++ b/packages/amplify-e2e-tests/package.json
@@ -44,7 +44,7 @@
     "yargs": "^15.1.0"
   },
   "devDependencies": {
-    "ts-node": "^8.9.0"
+    "ts-node": "^8.10.2"
   },
   "jest": {
     "verbose": false,
diff --git a/packages/amplify-e2e-tests/src/__tests__/storage.test.ts b/packages/amplify-e2e-tests/src/__tests__/storage.test.ts
index 08d71dcfe06..efd4d818e5b 100644
--- a/packages/amplify-e2e-tests/src/__tests__/storage.test.ts
+++ b/packages/amplify-e2e-tests/src/__tests__/storage.test.ts
@@ -1,7 +1,10 @@
+import { JSONUtilities } from 'amplify-cli-core';
 import { initJSProjectWithProfile, initFlutterProjectWithProfile, deleteProject, amplifyPushAuth } from 'amplify-e2e-core';
 import { addAuthWithDefault, addAuthWithGroupsAndAdminAPI } from 'amplify-e2e-core';
 import {
   addSimpleDDB,
+  overrideDDB,
+  buildOverrideStorage,
   addDDBWithTrigger,
   updateDDBWithTrigger,
   addSimpleDDBwithGSI,
@@ -15,6 +18,7 @@ import {
 import { createNewProjectDir, deleteProjectDir, getProjectMeta, getDDBTable, checkIfBucketExists } from 'amplify-e2e-core';
 import * as fs from 'fs-extra';
 import * as path from 'path';
+import uuid from 'uuid';
 
 describe('amplify add/update storage(S3)', () => {
   let projRoot: string;
@@ -128,9 +132,12 @@ describe('amplify add/update storage(DDB)', () => {
     await amplifyPushAuth(projRoot);
 
     const meta = getProjectMeta(projRoot);
-    const { Name: table1Name, Arn: table1Arn, Region: table1Region, StreamArn: table1StreamArn } = Object.keys(meta.storage).map(
-      key => meta.storage[key],
-    )[0].output;
+    const {
+      Name: table1Name,
+      Arn: table1Arn,
+      Region: table1Region,
+      StreamArn: table1StreamArn,
+    } = Object.keys(meta.storage).map(key => meta.storage[key])[0].output;
 
     expect(table1Name).toBeDefined();
     expect(table1Arn).toBeDefined();
@@ -140,9 +147,12 @@ describe('amplify add/update storage(DDB)', () => {
 
     expect(table1Configs.Table.TableArn).toEqual(table1Arn);
 
-    const { Name: table2Name, Arn: table2Arn, Region: table2Region, StreamArn: table2StreamArn } = Object.keys(meta.storage).map(
-      key => meta.storage[key],
-    )[1].output;
+    const {
+      Name: table2Name,
+      Arn: table2Arn,
+      Region: table2Region,
+      StreamArn: table2StreamArn,
+    } = Object.keys(meta.storage).map(key => meta.storage[key])[1].output;
 
     expect(table2Name).toBeDefined();
     expect(table2Arn).toBeDefined();
@@ -152,3 +162,58 @@ describe('amplify add/update storage(DDB)', () => {
     expect(table2Configs.Table.TableArn).toEqual(table2Arn);
   });
 });
+
+describe('ddb override tests', () => {
+  let projRoot: string;
+  beforeEach(async () => {
+    projRoot = await createNewProjectDir('ddb-overrides');
+  });
+
+  afterEach(async () => {
+    await deleteProject(projRoot);
+    deleteProjectDir(projRoot);
+  });
+
+  it('override DDB StreamSpecification property', async () => {
+    const resourceName = `dynamo${uuid.v4().split('-')[0]}`;
+    await initJSProjectWithProfile(projRoot, {});
+    await addSimpleDDB(projRoot, { name: resourceName });
+    await overrideDDB(projRoot, {});
+
+    const srcOverrideFilePath = path.join(__dirname, '..', '..', 'overrides', 'override-storage-ddb.ts');
+    const destOverrideFilePath = path.join(projRoot, 'amplify', 'backend', 'storage', resourceName, 'override.ts');
+    const cfnFilePath = path.join(projRoot, 'amplify', 'backend', 'storage', resourceName, 'build', 'cloudformation-template.json');
+
+    fs.copyFileSync(srcOverrideFilePath, destOverrideFilePath);
+
+    await buildOverrideStorage(projRoot, {});
+
+    let ddbCFNFileJSON: any = JSONUtilities.readJson(cfnFilePath);
+
+    // check if overrides are applied to the cfn file
+    expect(ddbCFNFileJSON?.Resources?.DynamoDBTable?.Properties?.StreamSpecification?.StreamViewType).toEqual('NEW_AND_OLD_IMAGES');
+
+    await updateDDBWithTrigger(projRoot, {});
+
+    // check if override persists after an update
+    ddbCFNFileJSON = JSONUtilities.readJson(cfnFilePath);
+    expect(ddbCFNFileJSON?.Resources?.DynamoDBTable?.Properties?.StreamSpecification?.StreamViewType).toEqual('NEW_AND_OLD_IMAGES');
+
+    await amplifyPushAuth(projRoot);
+
+    const meta = getProjectMeta(projRoot);
+    const {
+      Name: table1Name,
+      Arn: table1Arn,
+      Region: table1Region,
+      StreamArn: table1StreamArn,
+    } = Object.keys(meta.storage).map(key => meta.storage[key])[0].output;
+
+    expect(table1Name).toBeDefined();
+    expect(table1Arn).toBeDefined();
+    expect(table1Region).toBeDefined();
+    expect(table1StreamArn).toBeDefined();
+    const table1Configs = await getDDBTable(table1Name, table1Region);
+    expect(table1Configs.Table.TableArn).toEqual(table1Arn);
+  });
+});

From 5a2a702d373c7f090b0a9357e1b33350ce574066 Mon Sep 17 00:00:00 2001
From: akshbhu <39866697+akshbhu@users.noreply.github.com>
Date: Thu, 14 Oct 2021 09:00:39 -0700
Subject: [PATCH 6/6] feat: Auth refactor to  use cdk, eliminate EJS, overrides
 functionality (#8355)

* feat: add auth override

* fix: auth state unit tests working

* feat: auth e2e fixes and migration e2e included

* fix: fixes package name

* fix: unit tests fix

* fix: unit tests

* fix: fixing overwritten files

* fix: added vm2 and addressed comments

* fix: minor fixes and e2e test for overrides

* fix: cli-core unit test

* fix: userPool group unit test

* fix: minor refractor and comments

* chore: lgtm warnings

* fix: minor fixes

* fix: unit tests
---
 .eslintrc.js                                  |    1 +
 packages/amplify-category-auth/CHANGELOG.md   | 1653 -----------
 packages/amplify-category-auth/Readme.md      |    8 +-
 .../amplify-category-auth/amplify-plugin.json |    2 +-
 packages/amplify-category-auth/package.json   |   10 +-
 .../function-template-dir/event.json          |    8 +-
 .../CustomMessage/CustomMessage.map.json      |    6 +-
 .../triggers/CustomMessage/assets/index.html  |   12 +-
 .../triggers/CustomMessage/assets/spinner.js  |   10 +-
 .../triggers/CustomMessage/assets/style.css   |   12 +-
 .../triggers/CustomMessage/assets/verify.js   |    2 +-
 .../function-template-dir/event.json          |   18 +-
 .../DefineAuthChallenge.map.json              |    2 +-
 .../function-template-dir/event.json          |    8 +-
 .../PostAuthentication.map.json               |    4 +-
 .../function-template-dir/event.json          |    8 +-
 .../PostConfirmation.map.json                 |    4 +-
 .../function-template-dir/event.json          |   12 +-
 .../PreAuthentication.map.json                |    4 +-
 .../function-template-dir/event.json          |   14 +-
 .../VerifyAuthChallengeResponse.map.json      |    4 +-
 .../function-template-dir/event.json          |    8 +-
 .../triggers/cognito.map.json                 |    2 +-
 .../resources/adminAuth/admin-auth-app.js     |    7 +-
 .../auth-custom-resource/hostedUILambda.js    |   81 +
 .../hostedUIProviderLambda.js                 |  100 +
 .../auth-custom-resource/mfaLambda.js         |   37 +
 .../auth-custom-resource/oauthLambda.js       |   45 +
 .../auth-custom-resource/openIdLambda.js      |   77 +
 .../role-map-lambda-function.js               |   37 +
 .../userpoolclientLambda.js                   |   23 +
 .../resources/overrides-resource/override.ts  |    6 +
 .../resources/overrides-resource/package.json |   18 +
 .../overrides-resource/tsconfig.json          |   11 +
 .../overrides-resource/tsconfig.resource.json |   13 +
 .../awsCognito/CognitoCLIInputs.schema.json   |  290 ++
 .../scripts/generateAuthSchemas.ts            |   14 +
 .../{enable.test.js => enable.test.ts}        |    2 -
 .../commands/import.headless.test.ts          |   19 +-
 .../src/__tests__/commands/override.test.ts   |   65 +
 .../src/__tests__/commands/remove.test.js     |   77 -
 .../src/__tests__/commands/remove.test.ts     |  130 +
 .../{update.test.js => update.test.ts}        |  108 +-
 .../src/__tests__/mocks/cli-inputs.json       |   77 +
 .../auth-input-state.test.ts                  |  109 +
 .../auth-stack-transform.test.ts.snap         | 2486 +++++++++++++++++
 ...er-pool-group-stack-transform.test.ts.snap |  591 ++++
 .../auth-stack-transform.test.ts              |  188 ++
 .../user-pool-group-stack-transform.test.ts   |   73 +
 .../auth-request-adaptor.test.ts.snap         |   31 -
 .../utils/auth-defaults-appliers.test.ts      |   18 +-
 .../utils/auth-request-adaptor.test.ts        |   26 -
 .../utils/auth-sms-workflow-helper.test.ts    |   10 +-
 .../utils/check-for-auth-migration.test.ts    |   79 +
 .../utils/message-printer.test.ts             |   14 +-
 .../utils/migrate-override-resource.test.ts   |  128 +
 .../provider-utils/supported-services.test.ts |   33 -
 .../src/commands/auth.js                      |   47 -
 .../src/commands/auth.ts                      |   49 +
 .../src/commands/auth/add.js                  |    6 -
 .../src/commands/auth/add.ts                  |    8 +
 .../src/commands/auth/console.js              |    9 -
 .../src/commands/auth/console.ts              |    5 +
 .../src/commands/auth/enable.js               |   24 -
 .../src/commands/auth/enable.ts               |   23 +
 .../src/commands/auth/import.ts               |   10 +-
 .../src/commands/auth/override.ts             |   31 +
 .../src/commands/auth/push.js                 |   23 -
 .../src/commands/auth/push.ts                 |   22 +
 .../src/commands/auth/remove.js               |   49 -
 .../src/commands/auth/remove.ts               |   37 +
 .../src/commands/auth/update.js               |   98 -
 .../src/commands/auth/update.ts               |   75 +
 packages/amplify-category-auth/src/index.js   |   98 +-
 .../assets/cognito-defaults.js                |   11 -
 .../awscloudformation/assets/string-maps.js   |    3 +-
 .../auth-inputs-manager/auth-input-state.ts   |   98 +
 .../auth-cognito-stack-builder.ts             | 1148 ++++++++
 .../auth-stack-transform.ts                   |  522 ++++
 .../auth-user-pool-group-stack-builder.ts     |  335 +++
 .../auth-stack-builder/index.ts               |    5 +
 .../auth-stack-builder/stack-synthesizer.ts   |   45 +
 .../auth-stack-builder/types.ts               |   59 +
 .../user-pool-group-stack-transform.ts        |  240 ++
 .../awscloudformation/constants.ts            |   14 +-
 .../handlers/resource-handlers.ts             |  170 +-
 .../provider-utils/awscloudformation/index.js |   18 +-
 .../awsCognito/CognitoCLIInputs.schema.json   |  275 ++
 .../awsCognito-user-input-types.ts            |  118 +
 .../cognito-user-input-types.ts}              |   42 +-
 .../utils/amplify-meta-updaters.ts            |   10 +-
 .../utils/attach-prev-params-to-context.ts    |    6 +-
 .../utils/auth-defaults-appliers.ts           |   80 +-
 .../utils/auth-request-adaptors.ts            |   17 +-
 .../utils/auth-sms-workflow-helper.ts         |   21 +-
 .../utils/check-for-auth-migration.ts         |   21 +
 .../utils/generate-auth-stack-template.ts     |    7 +
 .../utils/generate-auth-trigger-template.ts   |   28 +-
 ...generate-user-pool-group-stack-template.ts |   12 +
 .../utils/message-printer.ts                  |   19 +-
 .../utils/migrate-override-resource.ts        |  190 ++
 .../utils/synthesize-resources.ts             |   79 +-
 .../utils/transform-user-pool-group.js        |   35 +-
 .../utils/trigger-file-uploader.js            |    2 +-
 .../utils/verification-bucket-name.ts         |    2 +-
 .../src/provider-utils/supported-services.ts  |   35 +-
 ...ResourceName.js => getAuthResourceName.ts} |   10 +-
 packages/amplify-category-auth/tsconfig.json  |    5 +-
 .../category-override-base.ts                 |    4 +-
 packages/amplify-cli-core/src/cliConstants.ts |    1 +
 packages/amplify-cli-core/src/index.ts        |    5 +-
 .../override-skeleton-generator.ts            |    6 +
 .../src/state-manager/pathManager.ts          |    4 +-
 .../amplify-cli-overrides-helper/package.json |    3 +-
 .../tsconfig.json                             |    2 +-
 packages/amplify-cli/package.json             |   14 +-
 .../get-frontend-plugins.test.ts              |    8 +-
 .../__tests__/team-provider-migrate.test.ts   |    2 +-
 .../src/__tests__/test-aborting.test.ts       |    1 +
 .../src/commands/build-override.ts            |    2 -
 .../on-category-outputs-change.ts             |    2 +-
 .../amplify-helpers/trigger-flow.ts           |    6 +-
 .../src/utils/team-provider-migrate.ts        |    2 +-
 packages/amplify-cli/tsconfig.json            |    3 +-
 .../amplify-e2e-core/src/categories/auth.ts   |   57 +-
 packages/amplify-e2e-core/src/init/index.ts   |    2 +-
 ...{overrideRootStack.ts => overrideStack.ts} |   18 +
 .../amplify-e2e-core/src/utils/projectMeta.ts |    2 +-
 .../overrides/override-auth.ts                |    6 +
 .../src/__tests__/auth_1.test.ts              |    6 +-
 .../src/__tests__/auth_6.test.ts              |   30 +
 .../src/import-helpers/utilities.ts           |    6 +-
 packages/amplify-migration-tests/package.json |    2 +-
 .../overrides/auth-migration.test.ts          |  139 +
 .../package.json                              |    1 +
 .../root-stack-transform.ts                   |   41 +-
 .../root-stack-builder/stack-synthesizer.ts   |    9 +-
 137 files changed, 8878 insertions(+), 2637 deletions(-)
 create mode 100644 packages/amplify-category-auth/resources/auth-custom-resource/hostedUILambda.js
 create mode 100644 packages/amplify-category-auth/resources/auth-custom-resource/hostedUIProviderLambda.js
 create mode 100644 packages/amplify-category-auth/resources/auth-custom-resource/mfaLambda.js
 create mode 100644 packages/amplify-category-auth/resources/auth-custom-resource/oauthLambda.js
 create mode 100644 packages/amplify-category-auth/resources/auth-custom-resource/openIdLambda.js
 create mode 100644 packages/amplify-category-auth/resources/auth-custom-resource/role-map-lambda-function.js
 create mode 100644 packages/amplify-category-auth/resources/auth-custom-resource/userpoolclientLambda.js
 create mode 100644 packages/amplify-category-auth/resources/overrides-resource/override.ts
 create mode 100644 packages/amplify-category-auth/resources/overrides-resource/package.json
 create mode 100644 packages/amplify-category-auth/resources/overrides-resource/tsconfig.json
 create mode 100644 packages/amplify-category-auth/resources/overrides-resource/tsconfig.resource.json
 create mode 100644 packages/amplify-category-auth/resources/schemas/awsCognito/CognitoCLIInputs.schema.json
 create mode 100644 packages/amplify-category-auth/scripts/generateAuthSchemas.ts
 rename packages/amplify-category-auth/src/__tests__/commands/{enable.test.js => enable.test.ts} (95%)
 create mode 100644 packages/amplify-category-auth/src/__tests__/commands/override.test.ts
 delete mode 100644 packages/amplify-category-auth/src/__tests__/commands/remove.test.js
 create mode 100644 packages/amplify-category-auth/src/__tests__/commands/remove.test.ts
 rename packages/amplify-category-auth/src/__tests__/commands/{update.test.js => update.test.ts} (52%)
 create mode 100644 packages/amplify-category-auth/src/__tests__/mocks/cli-inputs.json
 create mode 100644 packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-inputs-manager/auth-input-state.test.ts
 create mode 100644 packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/__snapshots__/auth-stack-transform.test.ts.snap
 create mode 100644 packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/__snapshots__/user-pool-group-stack-transform.test.ts.snap
 create mode 100644 packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/auth-stack-transform.test.ts
 create mode 100644 packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/user-pool-group-stack-transform.test.ts
 create mode 100644 packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/check-for-auth-migration.test.ts
 create mode 100644 packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/migrate-override-resource.test.ts
 delete mode 100644 packages/amplify-category-auth/src/__tests__/provider-utils/supported-services.test.ts
 delete mode 100644 packages/amplify-category-auth/src/commands/auth.js
 create mode 100644 packages/amplify-category-auth/src/commands/auth.ts
 delete mode 100644 packages/amplify-category-auth/src/commands/auth/add.js
 create mode 100644 packages/amplify-category-auth/src/commands/auth/add.ts
 delete mode 100644 packages/amplify-category-auth/src/commands/auth/console.js
 create mode 100644 packages/amplify-category-auth/src/commands/auth/console.ts
 delete mode 100644 packages/amplify-category-auth/src/commands/auth/enable.js
 create mode 100644 packages/amplify-category-auth/src/commands/auth/enable.ts
 create mode 100644 packages/amplify-category-auth/src/commands/auth/override.ts
 delete mode 100644 packages/amplify-category-auth/src/commands/auth/push.js
 create mode 100644 packages/amplify-category-auth/src/commands/auth/push.ts
 delete mode 100644 packages/amplify-category-auth/src/commands/auth/remove.js
 create mode 100644 packages/amplify-category-auth/src/commands/auth/remove.ts
 delete mode 100644 packages/amplify-category-auth/src/commands/auth/update.js
 create mode 100644 packages/amplify-category-auth/src/commands/auth/update.ts
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-inputs-manager/auth-input-state.ts
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/auth-cognito-stack-builder.ts
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/auth-stack-transform.ts
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/auth-user-pool-group-stack-builder.ts
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/index.ts
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/stack-synthesizer.ts
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/types.ts
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/user-pool-group-stack-transform.ts
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/schemas/awsCognito/CognitoCLIInputs.schema.json
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/service-walkthrough-types/awsCognito-user-input-types.ts
 rename packages/amplify-category-auth/src/provider-utils/awscloudformation/{service-walkthrough-types.ts => service-walkthrough-types/cognito-user-input-types.ts} (77%)
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/check-for-auth-migration.ts
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/generate-auth-stack-template.ts
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/generate-user-pool-group-stack-template.ts
 create mode 100644 packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/migrate-override-resource.ts
 rename packages/amplify-category-auth/src/utils/{getAuthResourceName.js => getAuthResourceName.ts} (58%)
 rename packages/amplify-e2e-core/src/init/{overrideRootStack.ts => overrideStack.ts} (52%)
 create mode 100644 packages/amplify-e2e-tests/overrides/override-auth.ts
 create mode 100644 packages/amplify-migration-tests/src/__tests__/migration_tests/overrides/auth-migration.test.ts

diff --git a/.eslintrc.js b/.eslintrc.js
index 89a006999ab..0d8711f41db 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -324,6 +324,7 @@ module.exports = {
     '/packages/amplify-provider-awscloudformation/lib',
     '/packages/amplify-console-integration-tests/lib',
     '/packages/amplify-cli-overrides-helper/lib',
+    '/packages/amplify-category-auth/resources/auth-custom-resource',
 
     // Ignore CHANGELOG.md files
     '/packages/*/CHANGELOG.md',
diff --git a/packages/amplify-category-auth/CHANGELOG.md b/packages/amplify-category-auth/CHANGELOG.md
index 6ec9fe340a3..e69de29bb2d 100644
--- a/packages/amplify-category-auth/CHANGELOG.md
+++ b/packages/amplify-category-auth/CHANGELOG.md
@@ -1,1653 +0,0 @@
-# Change Log
-
-All notable changes to this project will be documented in this file.
-See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
-
-## [2.38.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.38.0...amplify-category-auth@2.38.1) (2021-09-20)
-
-
-
-## 6.0.1 (2021-09-20)
-
-
-### Bug Fixes
-
-* **amplify-category-auth:** handle undefined aliasattributes ([#8222](https://github.com/aws-amplify/amplify-cli/issues/8222)) ([c3b89af](https://github.com/aws-amplify/amplify-cli/commit/c3b89afbc410dd5de7964a8002dd4dc459199d00))
-
-
-
-
-
-# [2.38.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.37.0...amplify-category-auth@2.38.0) (2021-09-18)
-
-
-### Bug Fixes
-
-* added warning for usernameAttributes ([#8202](https://github.com/aws-amplify/amplify-cli/issues/8202)) ([b56eef0](https://github.com/aws-amplify/amplify-cli/commit/b56eef07a42b6d44f3834a4f204bd029eb653a2e))
-* **amplify-category-auth:** check for undefined aliasAttributes ([#8203](https://github.com/aws-amplify/amplify-cli/issues/8203)) ([c68dda1](https://github.com/aws-amplify/amplify-cli/commit/c68dda1888efe4fcc6d837864a50db54630cff5e))
-
-
-### Features
-
-* **amplify-category-auth:** use usernameAttributes by default, FF for aliasAttributes ([#8188](https://github.com/aws-amplify/amplify-cli/issues/8188)) ([f3044ee](https://github.com/aws-amplify/amplify-cli/commit/f3044eeff21fa900da5aac613db87502526bc165))
-
-
-
-
-
-# [2.37.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.36.5...amplify-category-auth@2.37.0) (2021-09-14)
-
-
-### Bug Fixes
-
-* remove overwrite of email-only verification when triggers are added ([#7671](https://github.com/aws-amplify/amplify-cli/issues/7671)) ([704295b](https://github.com/aws-amplify/amplify-cli/commit/704295b918701eb81fdaabb786417463672fa02c))
-* verification-link variable with small typo ([#8073](https://github.com/aws-amplify/amplify-cli/issues/8073)) ([d9afc20](https://github.com/aws-amplify/amplify-cli/commit/d9afc20864cbfcc1eadc3e5c262888187624a5ad))
-
-
-### Features
-
-* **amplify-category-auth:** add auth verification mechanisms to frontend config ([#8037](https://github.com/aws-amplify/amplify-cli/issues/8037)) ([88494b3](https://github.com/aws-amplify/amplify-cli/commit/88494b3f12a9989273aa3ae3e68c629f4c4cdff9))
-* **amplify-category-auth:** add auth verification mechanisms to frontend config ([#8037](https://github.com/aws-amplify/amplify-cli/issues/8037)) ([#8093](https://github.com/aws-amplify/amplify-cli/issues/8093)) ([b8949b2](https://github.com/aws-amplify/amplify-cli/commit/b8949b2b519f6b6a26bcab3596c051acec51e077))
-
-
-### Reverts
-
-* Revert "feat(amplify-category-auth): add auth verification mechanisms to frontend config (#8037) (#8093)" (#8158) ([50f07ef](https://github.com/aws-amplify/amplify-cli/commit/50f07efcf7c5663b6fd123d300ec473377d03abe)), closes [#8037](https://github.com/aws-amplify/amplify-cli/issues/8037) [#8093](https://github.com/aws-amplify/amplify-cli/issues/8093) [#8158](https://github.com/aws-amplify/amplify-cli/issues/8158)
-
-
-
-
-
-## [2.36.5](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.36.4...amplify-category-auth@2.36.5) (2021-09-09)
-
-
-### Bug Fixes
-
-* **amplify-category-auth:** update attr mapping... ([#7979](https://github.com/aws-amplify/amplify-cli/issues/7979)) ([94d2491](https://github.com/aws-amplify/amplify-cli/commit/94d2491ca8b41c1673cca0dd7bf96ac1c3f2db69)), closes [#7793](https://github.com/aws-amplify/amplify-cli/issues/7793)
-
-
-### Reverts
-
-* Revert "fix(amplify-category-auth): update attr mapping... (#7979)" (#8115) ([35af7e1](https://github.com/aws-amplify/amplify-cli/commit/35af7e147d817206fe979fe2320e074407204a0a)), closes [#7979](https://github.com/aws-amplify/amplify-cli/issues/7979) [#8115](https://github.com/aws-amplify/amplify-cli/issues/8115)
-
-
-
-
-
-## [2.36.4](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.36.3...amplify-category-auth@2.36.4) (2021-09-02)
-
-
-### Bug Fixes
-
-* **amplify-category-auth:** fixed walkthrough prompt after choosing same web & native app clients ([#7954](https://github.com/aws-amplify/amplify-cli/issues/7954)) ([49d0e51](https://github.com/aws-amplify/amplify-cli/commit/49d0e51e6cf8b9e986dc309abdb67df930b0da13))
-
-
-
-
-
-## [2.36.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.36.2...amplify-category-auth@2.36.3) (2021-08-24)
-
-
-### Bug Fixes
-
-* **amplify-category-auth:** fixed no parameter when hostedui is not present ([#7914](https://github.com/aws-amplify/amplify-cli/issues/7914)) ([a83c978](https://github.com/aws-amplify/amplify-cli/commit/a83c978bb18c6fc1980343523c7ee560079cefe5))
-
-
-
-
-
-## [2.36.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.36.1...amplify-category-auth@2.36.2) (2021-08-06)
-
-
-### Bug Fixes
-
-* **amplify-category-auth:** add auth user selections to aws-exports/amplifyconfiguration files ([#7807](https://github.com/aws-amplify/amplify-cli/issues/7807)) ([3deae39](https://github.com/aws-amplify/amplify-cli/commit/3deae3969740562c8fe1a82d2659e0efffccb49d))
-
-
-
-
-
-## [2.36.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.36.0...amplify-category-auth@2.36.1) (2021-07-30)
-
-
-### Bug Fixes
-
-* lambda timeout should be an integer type ([#7699](https://github.com/aws-amplify/amplify-cli/issues/7699)) ([cbacf4d](https://github.com/aws-amplify/amplify-cli/commit/cbacf4d3e497421855c09825970e025550aacfd7))
-
-
-
-
-
-# [2.36.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.35.1...amplify-category-auth@2.36.0) (2021-07-27)
-
-
-### Bug Fixes
-
-* **amplify-category-auth:** add handling for undefined autoVerifiedAttributes ([#7780](https://github.com/aws-amplify/amplify-cli/issues/7780)) ([3aac45d](https://github.com/aws-amplify/amplify-cli/commit/3aac45d472903c2de2338409e71d6ba07248aa6b))
-* upgrade node default runtime to 14 ([#7700](https://github.com/aws-amplify/amplify-cli/issues/7700)) ([47968cc](https://github.com/aws-amplify/amplify-cli/commit/47968cc9c704ac1cffcbd0dbe40d164b1b1d48d6))
-
-
-### Features
-
-* **amplify-category-auth:** enable alternative signup/signin options ([#7461](https://github.com/aws-amplify/amplify-cli/issues/7461)) ([56a0c35](https://github.com/aws-amplify/amplify-cli/commit/56a0c35d2cef0fbff27c80f78dba57516ef18afb)), closes [#1546](https://github.com/aws-amplify/amplify-cli/issues/1546)
-* **amplify-category-auth:** use EnabledMFAs to only configure TOTP ([#7779](https://github.com/aws-amplify/amplify-cli/issues/7779)) ([c2102c5](https://github.com/aws-amplify/amplify-cli/commit/c2102c53fd2ca974fb95c4468ad7a87fefe14ab0))
-
-
-### Reverts
-
-* Revert "feat(amplify-category-auth): use EnabledMFAs to only configure TOTP (#7779)" (#7790) ([fa172c4](https://github.com/aws-amplify/amplify-cli/commit/fa172c4caf6f15de56925bd1ff4f8ee743788b52)), closes [#7779](https://github.com/aws-amplify/amplify-cli/issues/7779) [#7790](https://github.com/aws-amplify/amplify-cli/issues/7790)
-* Revert "fix: upgrade node default runtime to 14 (#7700)" (#7763) ([3ab8769](https://github.com/aws-amplify/amplify-cli/commit/3ab87694203584cdfa208bf75e648e0e944f5e18)), closes [#7700](https://github.com/aws-amplify/amplify-cli/issues/7700) [#7763](https://github.com/aws-amplify/amplify-cli/issues/7763)
-
-
-
-
-
-## [2.35.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.35.0...amplify-category-auth@2.35.1) (2021-07-16)
-
-
-
-## 5.1.2 (2021-07-15)
-
-
-### Bug Fixes
-
-* **amplify-category-auth:** \n made OS specific ([#7663](https://github.com/aws-amplify/amplify-cli/issues/7663)) ([3c0823e](https://github.com/aws-amplify/amplify-cli/commit/3c0823e8e004e00808351e958f5b587e8d77bd01)), closes [#7662](https://github.com/aws-amplify/amplify-cli/issues/7662)
-* **amplify-category-auth:** added passrole policy to MFALambaRole ([#7729](https://github.com/aws-amplify/amplify-cli/issues/7729)) ([cd5d33a](https://github.com/aws-amplify/amplify-cli/commit/cd5d33aa822ceeb19a1af847d8c3eab0f1d10632))
-* **auth:** standardize CloudFormation trigger templates, prevent errors at runtime ([#7219](https://github.com/aws-amplify/amplify-cli/issues/7219)) ([f9796bd](https://github.com/aws-amplify/amplify-cli/commit/f9796bd3aca6606f155d37ac6a8931d6bdec25b9))
-
-
-
-
-
-# [2.35.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.34.1...amplify-category-auth@2.35.0) (2021-07-12)
-
-
-
-## 5.1.1 (2021-07-07)
-
-
-### Bug Fixes
-
-* **amplify-category-auth:** check for siwa Cognito idp params ([#7678](https://github.com/aws-amplify/amplify-cli/issues/7678)) ([0c0adfb](https://github.com/aws-amplify/amplify-cli/commit/0c0adfb78350a192d4f44b722d6038b23c505527))
-
-
-### Features
-
-* support for sign in with apple ([#7413](https://github.com/aws-amplify/amplify-cli/issues/7413)) ([00d6676](https://github.com/aws-amplify/amplify-cli/commit/00d6676b4c1d6995cac01956078f7b6ee6186814))
-
-
-
-
-
-## [2.34.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.34.0...amplify-category-auth@2.34.1) (2021-06-30)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-# [2.34.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.33.1...amplify-category-auth@2.34.0) (2021-06-24)
-
-
-### Features
-
-* **import-auth:** add headless support ([#7266](https://github.com/aws-amplify/amplify-cli/issues/7266)) ([7fa478b](https://github.com/aws-amplify/amplify-cli/commit/7fa478bbfebbbe70e286eb19d436d772c32c4fd2))
-
-
-
-
-
-## [2.33.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.33.0...amplify-category-auth@2.33.1) (2021-06-15)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-# [2.33.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.32.1...amplify-category-auth@2.33.0) (2021-06-02)
-
-
-
-# 4.52.0 (2021-06-01)
-
-
-### Features
-
-* add support for SMS Sandbox ([#7436](https://github.com/aws-amplify/amplify-cli/issues/7436)) ([cdcb626](https://github.com/aws-amplify/amplify-cli/commit/cdcb6260c11bbedef5b056fdcd730612d8bb3230))
-
-
-
-
-
-## [2.32.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.32.0...amplify-category-auth@2.32.1) (2021-05-26)
-
-
-
-## 4.51.3 (2021-05-25)
-
-
-### Bug Fixes
-
-* add `sharedId` in `externalAuthEnable()` ([#7315](https://github.com/aws-amplify/amplify-cli/issues/7315)) ([fd552b4](https://github.com/aws-amplify/amplify-cli/commit/fd552b4c8d34d67c05330ae79804b00daa976f1d))
-* scope down usage of PassRole ([#7317](https://github.com/aws-amplify/amplify-cli/issues/7317)) ([d4d9394](https://github.com/aws-amplify/amplify-cli/commit/d4d9394f33995a6852d5b00e09d38802798ca6d7))
-* update auth sms workflow check ([#7396](https://github.com/aws-amplify/amplify-cli/issues/7396)) ([07a6fe4](https://github.com/aws-amplify/amplify-cli/commit/07a6fe47d1c39d952eef242400cdbb7e8a6a11eb))
-
-
-
-
-
-# [2.32.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.31.1...amplify-category-auth@2.32.0) (2021-05-22)
-
-
-
-## 4.51.2 (2021-05-20)
-
-
-### Bug Fixes
-
-* updated ejs template for empty object triggers ([#7351](https://github.com/aws-amplify/amplify-cli/issues/7351)) ([572ddbd](https://github.com/aws-amplify/amplify-cli/commit/572ddbda4f339d364a8a20bab0053140cf798f34))
-
-
-### Features
-
-* prep work for Cognito SMS Sandbox [#2](https://github.com/aws-amplify/amplify-cli/issues/2) ([#7338](https://github.com/aws-amplify/amplify-cli/issues/7338)) ([3dbb3bf](https://github.com/aws-amplify/amplify-cli/commit/3dbb3bfc199fdd7faac68cdee236d2625d6fb1ea))
-
-
-
-
-
-## [2.31.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.31.0...amplify-category-auth@2.31.1) (2021-05-18)
-
-
-
-## 4.51.1 (2021-05-18)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-# [2.31.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.30.6...amplify-category-auth@2.31.0) (2021-05-14)
-
-
-
-# 4.51.0 (2021-05-13)
-
-
-### Bug Fixes
-
-* [#4657](https://github.com/aws-amplify/amplify-cli/issues/4657) preserve previous authSelections in update flow ([#7255](https://github.com/aws-amplify/amplify-cli/issues/7255)) ([afbaa08](https://github.com/aws-amplify/amplify-cli/commit/afbaa08ac54bb001b640c808cf136c124089e5fc))
-* e2e failed tests for auth Triggers PR ([#7262](https://github.com/aws-amplify/amplify-cli/issues/7262)) ([fedb6c4](https://github.com/aws-amplify/amplify-cli/commit/fedb6c49cf0695e21f59929e7d0554b59290f2f1))
-* ejs template fix when no triggers added ([#7267](https://github.com/aws-amplify/amplify-cli/issues/7267)) ([81786a8](https://github.com/aws-amplify/amplify-cli/commit/81786a8d654f3ba2550e59986d85a654e5ed44dd))
-
-
-### Features
-
-* prep work for SMS Sandbox support ([#7302](https://github.com/aws-amplify/amplify-cli/issues/7302)) ([d1f85d2](https://github.com/aws-amplify/amplify-cli/commit/d1f85d2e0a9c367b71defefe6d9e00737f681ca4))
-* Support for Apple Sign In ([#7265](https://github.com/aws-amplify/amplify-cli/issues/7265)) ([9f5e659](https://github.com/aws-amplify/amplify-cli/commit/9f5e659d63362c7f47eaa147c68d40d5bcc36fcc))
-
-
-
-
-
-## [2.30.6](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.30.4...amplify-category-auth@2.30.6) (2021-05-03)
-
-
-
-## 4.50.1 (2021-05-03)
-
-
-### Bug Fixes
-
-* render the right auth mode for admin queries in config files ([#7118](https://github.com/aws-amplify/amplify-cli/issues/7118)) ([8f8deba](https://github.com/aws-amplify/amplify-cli/commit/8f8deba9171a30433aa6820af1f32f5498db5028)), closes [#6983](https://github.com/aws-amplify/amplify-cli/issues/6983)
-
-
-
-
-
-## [2.30.5](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.30.4...amplify-category-auth@2.30.5) (2021-05-03)
-
-
-### Bug Fixes
-
-* render the right auth mode for admin queries in config files ([#7118](https://github.com/aws-amplify/amplify-cli/issues/7118)) ([8f8deba](https://github.com/aws-amplify/amplify-cli/commit/8f8deba9171a30433aa6820af1f32f5498db5028)), closes [#6983](https://github.com/aws-amplify/amplify-cli/issues/6983)
-
-
-
-
-
-## [2.30.4](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.30.3...amplify-category-auth@2.30.4) (2021-04-27)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.30.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.30.2...amplify-category-auth@2.30.3) (2021-04-19)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.30.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.30.1...amplify-category-auth@2.30.2) (2021-04-14)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.30.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.29.3...amplify-category-auth@2.30.1) (2021-04-09)
-
-
-### Bug Fixes
-
-* **amplify-category-auth:** add lambda with AdminQueries API permissions ([#6935](https://github.com/aws-amplify/amplify-cli/issues/6935)) ([756b0f7](https://github.com/aws-amplify/amplify-cli/commit/756b0f70e3b060a4603290c0ab1ff7e3033d6021)), closes [#6576](https://github.com/aws-amplify/amplify-cli/issues/6576)
-* **cli:** use more inclusive language ([#6919](https://github.com/aws-amplify/amplify-cli/issues/6919)) ([bb70464](https://github.com/aws-amplify/amplify-cli/commit/bb70464d6c24fa931c0eb80d234a496d936913f5))
-
-
-
-
-
-## [2.29.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.29.2...amplify-category-auth@2.29.3) (2021-03-24)
-
-
-
-## 4.46.1 (2021-03-23)
-
-
-### Bug Fixes
-
-* exclude env add from check ([a7e0351](https://github.com/aws-amplify/amplify-cli/commit/a7e035126e264abf1c075b17cbd9a82fa3963481))
-
-
-
-
-
-## [2.29.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.29.1...amplify-category-auth@2.29.2) (2021-03-23)
-
-
-### Bug Fixes
-
-* add sms auth message to cfn template ([#6789](https://github.com/aws-amplify/amplify-cli/issues/6789)) ([7f9ea84](https://github.com/aws-amplify/amplify-cli/commit/7f9ea84f741ec9001dac9be55944d05c4534acb3))
-
-
-
-
-
-## [2.29.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.29.0...amplify-category-auth@2.29.1) (2021-03-11)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-# [2.29.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.28.3...amplify-category-auth@2.29.0) (2021-03-05)
-
-
-### Features
-
-* remove OAuth prompt from pull and new env ([#6739](https://github.com/aws-amplify/amplify-cli/issues/6739)) ([8ff15a6](https://github.com/aws-amplify/amplify-cli/commit/8ff15a6ea2c3c687f0344fb4e17547097cd575ea))
-
-
-
-
-
-## [2.28.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.28.2...amplify-category-auth@2.28.3) (2021-02-26)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.28.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.28.1...amplify-category-auth@2.28.2) (2021-02-24)
-
-
-### Bug Fixes
-
-* **auth:** update oauth prompt help text to mention that selecting "no" will remove existing configuration ([#6670](https://github.com/aws-amplify/amplify-cli/issues/6670)) ([83ec192](https://github.com/aws-amplify/amplify-cli/commit/83ec1923bdeffc328d0e97b658657894a79f4ca0))
-* insert hostedUIProviderCreds empty array on hostedUI ([#6485](https://github.com/aws-amplify/amplify-cli/issues/6485)) ([5ebee51](https://github.com/aws-amplify/amplify-cli/commit/5ebee516373c0544f1400f054eb382bb5b887253))
-
-
-### Reverts
-
-* Revert "fix: insert hostedUIProviderCreds empty array on hostedUI (#6485)" (#6682) ([4185595](https://github.com/aws-amplify/amplify-cli/commit/41855953b074fe4179a68a4acaf9796515e12688)), closes [#6485](https://github.com/aws-amplify/amplify-cli/issues/6485) [#6682](https://github.com/aws-amplify/amplify-cli/issues/6682)
-
-
-
-
-
-## [2.28.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.28.0...amplify-category-auth@2.28.1) (2021-02-17)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-# [2.28.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.27.0...amplify-category-auth@2.28.0) (2021-02-11)
-
-
-### Features
-
-* dont open urls when CLI is running in CI ([#6503](https://github.com/aws-amplify/amplify-cli/issues/6503)) ([27546a7](https://github.com/aws-amplify/amplify-cli/commit/27546a78159ea95c636dbbd094fe6a4f7fb8f8f4)), closes [#5973](https://github.com/aws-amplify/amplify-cli/issues/5973)
-
-
-
-
-
-# [2.27.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.26.4...amplify-category-auth@2.27.0) (2021-02-10)
-
-
-### Bug Fixes
-
-* [#6397](https://github.com/aws-amplify/amplify-cli/issues/6397) - auth update overwrite parameters ([#6403](https://github.com/aws-amplify/amplify-cli/issues/6403)) ([75f5ace](https://github.com/aws-amplify/amplify-cli/commit/75f5ace173a6b36b943e2110845e411a2cce5d6d))
-* appclient secret output default to false ([#6333](https://github.com/aws-amplify/amplify-cli/issues/6333)) ([3da53b7](https://github.com/aws-amplify/amplify-cli/commit/3da53b7c9aacf718ebd8ea63e59928425af20764))
-* apply empty arrays as default values but not undefined values ([#6445](https://github.com/aws-amplify/amplify-cli/issues/6445)) ([c2d2a6c](https://github.com/aws-amplify/amplify-cli/commit/c2d2a6cbffaed255a4cac7738d4691dda25e8710))
-* correct given_name fb attribute mapping ([#6510](https://github.com/aws-amplify/amplify-cli/issues/6510)) ([c26d958](https://github.com/aws-amplify/amplify-cli/commit/c26d95866a0496b26d4d7581eb2096b87390f50e))
-* generating condition for user pool ([#6426](https://github.com/aws-amplify/amplify-cli/issues/6426)) ([4f35e08](https://github.com/aws-amplify/amplify-cli/commit/4f35e08e38900f59e4b98da1417deb204f072f6a))
-
-
-### Features
-
-* add support for importing userpool with no appclient secret ([#6404](https://github.com/aws-amplify/amplify-cli/issues/6404)) ([4ce4138](https://github.com/aws-amplify/amplify-cli/commit/4ce413829f14aa90ca9ca27510249f1c6c39909f)), closes [#6333](https://github.com/aws-amplify/amplify-cli/issues/6333)
-
-
-
-
-
-## [2.26.4](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.26.3...amplify-category-auth@2.26.4) (2021-01-08)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.26.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.26.2...amplify-category-auth@2.26.3) (2020-12-31)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.26.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.26.1...amplify-category-auth@2.26.2) (2020-12-21)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.26.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.26.0...amplify-category-auth@2.26.1) (2020-12-16)
-
-
-### Bug Fixes
-
-* [#4175](https://github.com/aws-amplify/amplify-cli/issues/4175) ([#6065](https://github.com/aws-amplify/amplify-cli/issues/6065)) ([85b1ae3](https://github.com/aws-amplify/amplify-cli/commit/85b1ae31253d06718e13a2e2ff8cca3fc1931073))
-* ensure auth selections overwrite defaults ([#6071](https://github.com/aws-amplify/amplify-cli/issues/6071)) ([4b22fb2](https://github.com/aws-amplify/amplify-cli/commit/4b22fb281ba1ba4efa6b9d41f736450f2a959cc7))
-
-
-### Reverts
-
-* Revert "fix: ensure auth selections overwrite defaults (#6071)" (#6179) ([05b88ad](https://github.com/aws-amplify/amplify-cli/commit/05b88ad1e8b9c286f38535ce8dfce58dc87d53fb)), closes [#6071](https://github.com/aws-amplify/amplify-cli/issues/6071) [#6179](https://github.com/aws-amplify/amplify-cli/issues/6179)
-
-
-
-
-
-# [2.26.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.25.1...amplify-category-auth@2.26.0) (2020-12-11)
-
-
-### Features
-
-* container-based deployments([#5727](https://github.com/aws-amplify/amplify-cli/issues/5727)) ([fad6377](https://github.com/aws-amplify/amplify-cli/commit/fad6377bd384862ca4429cb1a83eee90efd62b58))
-
-
-
-
-
-## [2.25.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.25.0...amplify-category-auth@2.25.1) (2020-12-07)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-# [2.25.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.24.4...amplify-category-auth@2.25.0) (2020-11-30)
-
-
-### Bug Fixes
-
-* add check for undefined appId ([#6009](https://github.com/aws-amplify/amplify-cli/issues/6009)) ([db9bf58](https://github.com/aws-amplify/amplify-cli/commit/db9bf58c5c721be1125aca6972ce76a9ef222cd9))
-* appId is only required for admin ([#6007](https://github.com/aws-amplify/amplify-cli/issues/6007)) ([6eee2a2](https://github.com/aws-amplify/amplify-cli/commit/6eee2a245d2deae9d6faf81c84bbcd551561cd5c))
-
-
-### Features
-
-* pre-deploy pull, new login mechanism and pkg cli updates ([#5941](https://github.com/aws-amplify/amplify-cli/issues/5941)) ([7274251](https://github.com/aws-amplify/amplify-cli/commit/7274251faadc1035acce5f44699b172e10e2e67d))
-
-
-
-
-
-## [2.24.4](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.24.3...amplify-category-auth@2.24.4) (2020-11-28)
-
-
-### Reverts
-
-* "fix: remove app client secret as best practice" ([#5992](https://github.com/aws-amplify/amplify-cli/issues/5992)) ([d7d7fcf](https://github.com/aws-amplify/amplify-cli/commit/d7d7fcf65fb2928f5d97c2ada9fac8ebf3522ee0)), closes [#5731](https://github.com/aws-amplify/amplify-cli/issues/5731) [#5829](https://github.com/aws-amplify/amplify-cli/issues/5829)
-
-
-
-
-
-## [2.24.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.24.2...amplify-category-auth@2.24.3) (2020-11-27)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.24.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.24.1...amplify-category-auth@2.24.2) (2020-11-26)
-
-
-### Bug Fixes
-
-* check hostedUI flag ([#5958](https://github.com/aws-amplify/amplify-cli/issues/5958)) ([ed310da](https://github.com/aws-amplify/amplify-cli/commit/ed310da1923b62242bf019f840deaa620aed32d1))
-
-
-
-
-
-## [2.24.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.24.0...amplify-category-auth@2.24.1) (2020-11-24)
-
-
-
-# 4.35.0 (2020-11-24)
-
-
-### Bug Fixes
-
-* headless auth remove oauth when empty config specified ([#5930](https://github.com/aws-amplify/amplify-cli/issues/5930)) ([bb0d028](https://github.com/aws-amplify/amplify-cli/commit/bb0d028704f6508402794d5357c7501b366c9099))
-* **amplify-category-auth:** external auth enabled bugfix ([#5916](https://github.com/aws-amplify/amplify-cli/issues/5916)) ([a782103](https://github.com/aws-amplify/amplify-cli/commit/a78210316aac2692b4fe6d1e75ccb12b97682792))
-* new auth triggers overwrite previous selections ([#5945](https://github.com/aws-amplify/amplify-cli/issues/5945)) ([419b6d3](https://github.com/aws-amplify/amplify-cli/commit/419b6d3997df25f0de4b55e5716a8dcbe2f042d9))
-
-
-
-
-
-# [2.24.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.22.1...amplify-category-auth@2.24.0) (2020-11-22)
-
-
-### Bug Fixes
-
-* remove app client secret as best practice ([#5731](https://github.com/aws-amplify/amplify-cli/issues/5731)) ([8bc0dd2](https://github.com/aws-amplify/amplify-cli/commit/8bc0dd2434b93c9a2cb1ff3bfad9cedd2d356c30))
-* team provider migration ([#5733](https://github.com/aws-amplify/amplify-cli/issues/5733)) ([d18f795](https://github.com/aws-amplify/amplify-cli/commit/d18f795560f0e671f63f1dcbe38931c951794619))
-
-
-### Features
-
-* storage import ([#5893](https://github.com/aws-amplify/amplify-cli/issues/5893)) ([ad7b028](https://github.com/aws-amplify/amplify-cli/commit/ad7b028330bcee64d5124be7f27a8494dc8e9400))
-
-
-
-
-
-# [2.23.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.7.3...amplify-category-auth@2.23.0) (2020-11-22)
-
-
-### Bug Fixes
-
-* [#1056](https://github.com/aws-amplify/amplify-cli/issues/1056), dedup environment file reading ([#2088](https://github.com/aws-amplify/amplify-cli/issues/2088)) ([940deaa](https://github.com/aws-amplify/amplify-cli/commit/940deaa6bbe7370e40e61946d0f1073623ba6e90))
-* [#429](https://github.com/aws-amplify/amplify-cli/issues/429) - Editor hanging bug ([#2086](https://github.com/aws-amplify/amplify-cli/issues/2086)) ([6767445](https://github.com/aws-amplify/amplify-cli/commit/676744549f903fa3a4804d814eb325301ed462ba))
-* add support for mobile hub migrated resources ([#5407](https://github.com/aws-amplify/amplify-cli/issues/5407)) ([5dfe287](https://github.com/aws-amplify/amplify-cli/commit/5dfe2872c153047ebdc56bc4f671fd57c12379d9))
-* Added check to stop prompts for cognito triggers while using env commands ([#5039](https://github.com/aws-amplify/amplify-cli/issues/5039)) ([744dbc4](https://github.com/aws-amplify/amplify-cli/commit/744dbc42e847e273160caf3672365391f055191b))
-* added exit code on remove ([#5427](https://github.com/aws-amplify/amplify-cli/issues/5427)) ([33132f7](https://github.com/aws-amplify/amplify-cli/commit/33132f764b290cafd345720409a5db8ea6088069))
-* admin queries typo ([#5038](https://github.com/aws-amplify/amplify-cli/issues/5038)) ([1f37437](https://github.com/aws-amplify/amplify-cli/commit/1f374373061fff59b97e0f7ab3b3b84d1412416e))
-* change auth method copy [#4184](https://github.com/aws-amplify/amplify-cli/issues/4184) ([#4198](https://github.com/aws-amplify/amplify-cli/issues/4198)) ([8097671](https://github.com/aws-amplify/amplify-cli/commit/809767143ebf7dd6868279407461d0657e83073a))
-* change trigger assets path ([#5223](https://github.com/aws-amplify/amplify-cli/issues/5223)) ([f3eb615](https://github.com/aws-amplify/amplify-cli/commit/f3eb615a40bdb279938f9722d32468833d20f7b0))
-* data inconsitency ([#5344](https://github.com/aws-amplify/amplify-cli/issues/5344)) ([bfe1903](https://github.com/aws-amplify/amplify-cli/commit/bfe19038b5b676056f45d7ffcc4c2460057936d8))
-* deleted extra carriageReturn calls, fixed grammar in Auth dx ([#4237](https://github.com/aws-amplify/amplify-cli/issues/4237)) ([e6ccdab](https://github.com/aws-amplify/amplify-cli/commit/e6ccdab3f213e5b68999c18dd4ed2d1b7f60f0de))
-* enable only-userpool flow without idp and addition of groups without roles tied to idp ([#3662](https://github.com/aws-amplify/amplify-cli/issues/3662)) ([67e0401](https://github.com/aws-amplify/amplify-cli/commit/67e04018d758e617374c4b8ba2298872e728d01e))
-* Fix string literal to be a `Ref` in the cloud formation template ([#3630](https://github.com/aws-amplify/amplify-cli/issues/3630)) ([61e4ac9](https://github.com/aws-amplify/amplify-cli/commit/61e4ac95acc728c46440927c79c158b35abe0e39))
-* headless auth required attributes must be an array ([#5467](https://github.com/aws-amplify/amplify-cli/issues/5467)) ([dbde67c](https://github.com/aws-amplify/amplify-cli/commit/dbde67c3c39ecb14b32da82546927cee14405a0b))
-* imports and addResource return val ([#5279](https://github.com/aws-amplify/amplify-cli/issues/5279)) ([963b47c](https://github.com/aws-amplify/amplify-cli/commit/963b47c476113a7ba50646f01d7e57add11ad920))
-* internal add auth entry point ([#5281](https://github.com/aws-amplify/amplify-cli/issues/5281)) ([59734ac](https://github.com/aws-amplify/amplify-cli/commit/59734ac41f120771abdb31a1f6f796c852fe23b7))
-* move test package dependencies to devDependencies ([#2034](https://github.com/aws-amplify/amplify-cli/issues/2034)) ([f5623d0](https://github.com/aws-amplify/amplify-cli/commit/f5623d04a43e685901f4f1cd96e2a227164c71ee))
-* occurred spelling mistake ([#4595](https://github.com/aws-amplify/amplify-cli/issues/4595)) ([a461487](https://github.com/aws-amplify/amplify-cli/commit/a461487072dbf422892ca24c436581b49c568429))
-* prevent naming conflicts with new env names ([#3875](https://github.com/aws-amplify/amplify-cli/issues/3875)) ([a7734ae](https://github.com/aws-amplify/amplify-cli/commit/a7734aedb8e846620874ae69e5c38da393dbbe30)), closes [#3854](https://github.com/aws-amplify/amplify-cli/issues/3854)
-* randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-* refactor mobile hub migration checks ([#5632](https://github.com/aws-amplify/amplify-cli/issues/5632)) ([b796eb8](https://github.com/aws-amplify/amplify-cli/commit/b796eb8303bb903f5f531506254441a63eba2962))
-* remove app client secret as best practice ([#5731](https://github.com/aws-amplify/amplify-cli/issues/5731)) ([8bc0dd2](https://github.com/aws-amplify/amplify-cli/commit/8bc0dd2434b93c9a2cb1ff3bfad9cedd2d356c30))
-* scoping down user pool group IAM roles and adding --force to amplify push command ([#3609](https://github.com/aws-amplify/amplify-cli/issues/3609)) ([2e10a2f](https://github.com/aws-amplify/amplify-cli/commit/2e10a2ff62b61f57b2d513a7cfd0e4478f429f1f))
-* store oauthMetadata properly on headless update ([#5597](https://github.com/aws-amplify/amplify-cli/issues/5597)) ([bdadafc](https://github.com/aws-amplify/amplify-cli/commit/bdadafca991bf9227046dba22cb196ac66e26cc6))
-* team provider migration ([#5733](https://github.com/aws-amplify/amplify-cli/issues/5733)) ([d18f795](https://github.com/aws-amplify/amplify-cli/commit/d18f795560f0e671f63f1dcbe38931c951794619))
-* translate include oAuthMetadata and fix hostedUI meta ([#5304](https://github.com/aws-amplify/amplify-cli/issues/5304)) ([3c44c11](https://github.com/aws-amplify/amplify-cli/commit/3c44c110964907be203c4c70ee4e80122956fe85))
-* update auth supported services path ([#5184](https://github.com/aws-amplify/amplify-cli/issues/5184)) ([f8ff81d](https://github.com/aws-amplify/amplify-cli/commit/f8ff81da52f7a5376b5a36bdfed20d973b301f0f))
-* update current-cloud backend-config on resource removal ([#5658](https://github.com/aws-amplify/amplify-cli/issues/5658)) ([592f694](https://github.com/aws-amplify/amplify-cli/commit/592f694530dd61302ff790fbcf5b3ea135812c47))
-* username is default signin, doesn't need to be specified ([#5474](https://github.com/aws-amplify/amplify-cli/issues/5474)) ([4c42ad5](https://github.com/aws-amplify/amplify-cli/commit/4c42ad59db93144e131193c41c5f3d4aa4db1b92))
-* **amplify-category-api:** fix api add-graphql-datasource command ([#2320](https://github.com/aws-amplify/amplify-cli/issues/2320)) ([a9c829d](https://github.com/aws-amplify/amplify-cli/commit/a9c829d79e91246d2bb9a707ccfe886502ceebe2))
-* **amplify-category-auth:** checks for google idp federation on native ([#2541](https://github.com/aws-amplify/amplify-cli/issues/2541)) ([e1de9ac](https://github.com/aws-amplify/amplify-cli/commit/e1de9acac96dc0f7f7630fe8e75a0c0b89d15986)), closes [#2284](https://github.com/aws-amplify/amplify-cli/issues/2284) [#2284](https://github.com/aws-amplify/amplify-cli/issues/2284)
-* **amplify-category-auth:** consolidates parameters below limit ([#1948](https://github.com/aws-amplify/amplify-cli/issues/1948)) ([3cdbad8](https://github.com/aws-amplify/amplify-cli/commit/3cdbad863ad4febde47e56209d6026cddb344044))
-* **amplify-category-auth:** fix add to group cognito trigger bug [#2216](https://github.com/aws-amplify/amplify-cli/issues/2216) ([9471576](https://github.com/aws-amplify/amplify-cli/commit/9471576dbf802d2212997c616eff4c1104a4cfc0)), closes [#2214](https://github.com/aws-amplify/amplify-cli/issues/2214)
-* **amplify-category-auth:** fix auth console ([#5408](https://github.com/aws-amplify/amplify-cli/issues/5408)) ([afbe065](https://github.com/aws-amplify/amplify-cli/commit/afbe065757ce488c1769848d0db3d03465a9b6c9)), closes [#5364](https://github.com/aws-amplify/amplify-cli/issues/5364)
-* warning added for identity pool deletion ([#4731](https://github.com/aws-amplify/amplify-cli/issues/4731)) ([fb21a1c](https://github.com/aws-amplify/amplify-cli/commit/fb21a1cbb5d8b6254cca0ace6631c0a4e4820bba))
-* **amplify-category-auth:** adding unique Id to Role name ([#4231](https://github.com/aws-amplify/amplify-cli/issues/4231)) ([21de1af](https://github.com/aws-amplify/amplify-cli/commit/21de1affd89142598a1f8022c387b3c04994b1e0))
-* **amplify-category-auth:** adds trigger flag to lambda response ([#2548](https://github.com/aws-amplify/amplify-cli/issues/2548)) ([270b4ac](https://github.com/aws-amplify/amplify-cli/commit/270b4ac8464ac1800235beceed158f58a9538488))
-* **amplify-category-auth:** fixed issue with updating urls in auth ([#3791](https://github.com/aws-amplify/amplify-cli/issues/3791)) ([236cd7a](https://github.com/aws-amplify/amplify-cli/commit/236cd7aecbdc2cbbb0dc9c565aae4e79ff40ebae))
-* **amplify-category-auth:** removes deprecated props for external auth ([#2587](https://github.com/aws-amplify/amplify-cli/issues/2587)) ([08c0c70](https://github.com/aws-amplify/amplify-cli/commit/08c0c706bce7fd5996ce7c782512f694c1ff0455)), closes [#2309](https://github.com/aws-amplify/amplify-cli/issues/2309)
-* **amplify-cli:** updating path in trigger indexes for node10 ([c4b1082](https://github.com/aws-amplify/amplify-cli/commit/c4b10820232e614a2951d840a6307031df73aebd)), closes [#3083](https://github.com/aws-amplify/amplify-cli/issues/3083)
-* **cli:** add console command in the help message ([#2494](https://github.com/aws-amplify/amplify-cli/issues/2494)) ([cf0eddd](https://github.com/aws-amplify/amplify-cli/commit/cf0eddd1ba27b1126b0745cc068f205b2c2c8343)), closes [#1607](https://github.com/aws-amplify/amplify-cli/issues/1607)
-* **cli:** remove unnecessary stack trace log when adding services ([#4610](https://github.com/aws-amplify/amplify-cli/issues/4610)) ([56efb32](https://github.com/aws-amplify/amplify-cli/commit/56efb32b79c47839cb9506a9300d40a01875a9fc))
-
-
-### Features
-
-* add support for listing Amazon Cognito groups ([#5109](https://github.com/aws-amplify/amplify-cli/issues/5109)) ([3157652](https://github.com/aws-amplify/amplify-cli/commit/3157652ecf51171b1a7375351bee1ba4af9d5f18))
-* adding amplify cli predictions category ([#1936](https://github.com/aws-amplify/amplify-cli/issues/1936)) ([b7b7c2c](https://github.com/aws-amplify/amplify-cli/commit/b7b7c2c1927da10f8c54f38a523021187361131c))
-* Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-* feature flag implementation ([#4891](https://github.com/aws-amplify/amplify-cli/issues/4891)) ([6d1c632](https://github.com/aws-amplify/amplify-cli/commit/6d1c632952a49cb56670c11c9cb0c3620d0eb332))
-* headless add auth ([#5224](https://github.com/aws-amplify/amplify-cli/issues/5224)) ([9f80512](https://github.com/aws-amplify/amplify-cli/commit/9f805128a8232278bb27d4fb1eaa5fecf7aa7a63))
-* headless update auth ([#5308](https://github.com/aws-amplify/amplify-cli/issues/5308)) ([b942f35](https://github.com/aws-amplify/amplify-cli/commit/b942f3589f1df1361ae7eb6e42f18dbf6900d1bf))
-* Lambda layers ([#4697](https://github.com/aws-amplify/amplify-cli/issues/4697)) ([4e97400](https://github.com/aws-amplify/amplify-cli/commit/4e974007d95c894ab4108a2dff8d5996e7e3ce25))
-* storage import ([#5893](https://github.com/aws-amplify/amplify-cli/issues/5893)) ([ad7b028](https://github.com/aws-amplify/amplify-cli/commit/ad7b028330bcee64d5124be7f27a8494dc8e9400))
-* support importing of auth resources ([#5591](https://github.com/aws-amplify/amplify-cli/issues/5591)) ([7903246](https://github.com/aws-amplify/amplify-cli/commit/790324680544fe18481f91390001f9f07a144203))
-* **amplify-category-auth:** export lambda trigger roles in template ([#2894](https://github.com/aws-amplify/amplify-cli/issues/2894)) ([3d07717](https://github.com/aws-amplify/amplify-cli/commit/3d077179c28db7e2c8114bd88f27c99b08062313)), closes [#2303](https://github.com/aws-amplify/amplify-cli/issues/2303)
-* **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-* **cli:** usage measurement ([#3641](https://github.com/aws-amplify/amplify-cli/issues/3641)) ([a755863](https://github.com/aws-amplify/amplify-cli/commit/a7558637fbb791dc22e0a91ae16f1b96fe4e99df))
-* User Pool Groups, Admin Auth Support, Custom Group Role Policies ([#2443](https://github.com/aws-amplify/amplify-cli/issues/2443)) ([09aecfd](https://github.com/aws-amplify/amplify-cli/commit/09aecfd0cb3dae2c17d1c512946cc733c4fe3d4c))
-* **cli:** new plugin platform ([#2254](https://github.com/aws-amplify/amplify-cli/issues/2254)) ([7ec29dd](https://github.com/aws-amplify/amplify-cli/commit/7ec29dd4f2da8c90727b36469eca646d289877b6))
-
-
-### Performance Improvements
-
-* fulfill promises to upload files to S3 concurrently ([#4575](https://github.com/aws-amplify/amplify-cli/issues/4575)) ([9fbee8a](https://github.com/aws-amplify/amplify-cli/commit/9fbee8a71b4bf941dbda9d2f76fbedd73ab754ef)), closes [#4158](https://github.com/aws-amplify/amplify-cli/issues/4158)
-
-
-### Reverts
-
-* Revert "For the better security best practice, added PreventUserExistenceErrors: ENABLED. (#3534)" (#5736) ([3423228](https://github.com/aws-amplify/amplify-cli/commit/34232287c2e4dc466866528065c1900ac2954512)), closes [#3534](https://github.com/aws-amplify/amplify-cli/issues/3534) [#5736](https://github.com/aws-amplify/amplify-cli/issues/5736)
-* Revert problematic PRs (#4803) ([f21a0f4](https://github.com/aws-amplify/amplify-cli/commit/f21a0f449a23c0c80a6f3280eef76bcbf3e9cb7c)), closes [#4803](https://github.com/aws-amplify/amplify-cli/issues/4803) [#4796](https://github.com/aws-amplify/amplify-cli/issues/4796) [#4576](https://github.com/aws-amplify/amplify-cli/issues/4576) [#4575](https://github.com/aws-amplify/amplify-cli/issues/4575) [#4610](https://github.com/aws-amplify/amplify-cli/issues/4610)
-
-
-
-
-
-## [2.22.4](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.22.1...amplify-category-auth@2.22.4) (2020-11-20)
-
-
-### Bug Fixes
-
-* remove app client secret as best practice ([#5731](https://github.com/aws-amplify/amplify-cli/issues/5731)) ([8bc0dd2](https://github.com/aws-amplify/amplify-cli/commit/8bc0dd2434b93c9a2cb1ff3bfad9cedd2d356c30))
-* team provider migration ([#5733](https://github.com/aws-amplify/amplify-cli/issues/5733)) ([d18f795](https://github.com/aws-amplify/amplify-cli/commit/d18f795560f0e671f63f1dcbe38931c951794619))
-
-
-
-
-
-## [2.22.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.22.1...amplify-category-auth@2.22.3) (2020-11-20)
-
-
-### Bug Fixes
-
-* remove app client secret as best practice ([#5731](https://github.com/aws-amplify/amplify-cli/issues/5731)) ([8bc0dd2](https://github.com/aws-amplify/amplify-cli/commit/8bc0dd2434b93c9a2cb1ff3bfad9cedd2d356c30))
-* team provider migration ([#5733](https://github.com/aws-amplify/amplify-cli/issues/5733)) ([d18f795](https://github.com/aws-amplify/amplify-cli/commit/d18f795560f0e671f63f1dcbe38931c951794619))
-
-
-
-
-
-## [2.22.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.22.1...amplify-category-auth@2.22.2) (2020-11-19)
-
-
-### Bug Fixes
-
-* remove app client secret as best practice ([#5731](https://github.com/aws-amplify/amplify-cli/issues/5731)) ([8bc0dd2](https://github.com/aws-amplify/amplify-cli/commit/8bc0dd2434b93c9a2cb1ff3bfad9cedd2d356c30))
-* team provider migration ([#5733](https://github.com/aws-amplify/amplify-cli/issues/5733)) ([d18f795](https://github.com/aws-amplify/amplify-cli/commit/d18f795560f0e671f63f1dcbe38931c951794619))
-
-
-
-
-
-## [2.22.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.22.0...amplify-category-auth@2.22.1) (2020-11-08)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-# [2.22.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.21.2...amplify-category-auth@2.22.0) (2020-10-30)
-
-
-### Features
-
-* add support for listing Amazon Cognito groups ([#5109](https://github.com/aws-amplify/amplify-cli/issues/5109)) ([3157652](https://github.com/aws-amplify/amplify-cli/commit/3157652ecf51171b1a7375351bee1ba4af9d5f18))
-
-
-### Reverts
-
-* Revert "For the better security best practice, added PreventUserExistenceErrors: ENABLED. (#3534)" (#5736) ([3423228](https://github.com/aws-amplify/amplify-cli/commit/34232287c2e4dc466866528065c1900ac2954512)), closes [#3534](https://github.com/aws-amplify/amplify-cli/issues/3534) [#5736](https://github.com/aws-amplify/amplify-cli/issues/5736)
-
-
-
-
-
-## [2.21.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.21.1...amplify-category-auth@2.21.2) (2020-10-27)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.21.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.21.0...amplify-category-auth@2.21.1) (2020-10-22)
-
-
-### Bug Fixes
-
-* refactor mobile hub migration checks ([#5632](https://github.com/aws-amplify/amplify-cli/issues/5632)) ([b796eb8](https://github.com/aws-amplify/amplify-cli/commit/b796eb8303bb903f5f531506254441a63eba2962))
-* update current-cloud backend-config on resource removal ([#5658](https://github.com/aws-amplify/amplify-cli/issues/5658)) ([592f694](https://github.com/aws-amplify/amplify-cli/commit/592f694530dd61302ff790fbcf5b3ea135812c47))
-
-
-
-
-
-# [2.21.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.20.2...amplify-category-auth@2.21.0) (2020-10-17)
-
-
-### Bug Fixes
-
-* store oauthMetadata properly on headless update ([#5597](https://github.com/aws-amplify/amplify-cli/issues/5597)) ([bdadafc](https://github.com/aws-amplify/amplify-cli/commit/bdadafca991bf9227046dba22cb196ac66e26cc6))
-
-
-### Features
-
-* support importing of auth resources ([#5591](https://github.com/aws-amplify/amplify-cli/issues/5591)) ([7903246](https://github.com/aws-amplify/amplify-cli/commit/790324680544fe18481f91390001f9f07a144203))
-
-
-
-
-
-## [2.20.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.20.1...amplify-category-auth@2.20.2) (2020-10-07)
-
-
-### Bug Fixes
-
-* headless auth required attributes must be an array ([#5467](https://github.com/aws-amplify/amplify-cli/issues/5467)) ([dbde67c](https://github.com/aws-amplify/amplify-cli/commit/dbde67c3c39ecb14b32da82546927cee14405a0b))
-* username is default signin, doesn't need to be specified ([#5474](https://github.com/aws-amplify/amplify-cli/issues/5474)) ([4c42ad5](https://github.com/aws-amplify/amplify-cli/commit/4c42ad59db93144e131193c41c5f3d4aa4db1b92))
-
-
-
-
-
-## [2.20.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.20.0...amplify-category-auth@2.20.1) (2020-10-01)
-
-
-### Bug Fixes
-
-* **amplify-category-auth:** fix auth console ([#5408](https://github.com/aws-amplify/amplify-cli/issues/5408)) ([afbe065](https://github.com/aws-amplify/amplify-cli/commit/afbe065757ce488c1769848d0db3d03465a9b6c9)), closes [#5364](https://github.com/aws-amplify/amplify-cli/issues/5364)
-* add support for mobile hub migrated resources ([#5407](https://github.com/aws-amplify/amplify-cli/issues/5407)) ([5dfe287](https://github.com/aws-amplify/amplify-cli/commit/5dfe2872c153047ebdc56bc4f671fd57c12379d9))
-* added exit code on remove ([#5427](https://github.com/aws-amplify/amplify-cli/issues/5427)) ([33132f7](https://github.com/aws-amplify/amplify-cli/commit/33132f764b290cafd345720409a5db8ea6088069))
-
-
-
-
-
-# [2.20.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.19.1...amplify-category-auth@2.20.0) (2020-09-25)
-
-
-### Bug Fixes
-
-* data inconsitency ([#5344](https://github.com/aws-amplify/amplify-cli/issues/5344)) ([bfe1903](https://github.com/aws-amplify/amplify-cli/commit/bfe19038b5b676056f45d7ffcc4c2460057936d8))
-
-
-### Features
-
-* headless update auth ([#5308](https://github.com/aws-amplify/amplify-cli/issues/5308)) ([b942f35](https://github.com/aws-amplify/amplify-cli/commit/b942f3589f1df1361ae7eb6e42f18dbf6900d1bf))
-
-
-
-
-
-## [2.19.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.19.0...amplify-category-auth@2.19.1) (2020-09-16)
-
-
-### Bug Fixes
-
-* translate include oAuthMetadata and fix hostedUI meta ([#5304](https://github.com/aws-amplify/amplify-cli/issues/5304)) ([3c44c11](https://github.com/aws-amplify/amplify-cli/commit/3c44c110964907be203c4c70ee4e80122956fe85))
-
-
-
-
-
-# [2.19.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.18.6...amplify-category-auth@2.19.0) (2020-09-09)
-
-
-### Bug Fixes
-
-* imports and addResource return val ([#5279](https://github.com/aws-amplify/amplify-cli/issues/5279)) ([963b47c](https://github.com/aws-amplify/amplify-cli/commit/963b47c476113a7ba50646f01d7e57add11ad920))
-* internal add auth entry point ([#5281](https://github.com/aws-amplify/amplify-cli/issues/5281)) ([59734ac](https://github.com/aws-amplify/amplify-cli/commit/59734ac41f120771abdb31a1f6f796c852fe23b7))
-
-
-### Features
-
-* headless add auth ([#5224](https://github.com/aws-amplify/amplify-cli/issues/5224)) ([9f80512](https://github.com/aws-amplify/amplify-cli/commit/9f805128a8232278bb27d4fb1eaa5fecf7aa7a63))
-
-
-
-
-
-## [2.18.6](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.18.5...amplify-category-auth@2.18.6) (2020-09-03)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.18.5](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.18.4...amplify-category-auth@2.18.5) (2020-09-03)
-
-
-### Bug Fixes
-
-* change trigger assets path ([#5223](https://github.com/aws-amplify/amplify-cli/issues/5223)) ([f3eb615](https://github.com/aws-amplify/amplify-cli/commit/f3eb615a40bdb279938f9722d32468833d20f7b0))
-
-
-
-
-
-## [2.18.4](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.18.3...amplify-category-auth@2.18.4) (2020-08-31)
-
-
-### Bug Fixes
-
-* update auth supported services path ([#5184](https://github.com/aws-amplify/amplify-cli/issues/5184)) ([f8ff81d](https://github.com/aws-amplify/amplify-cli/commit/f8ff81da52f7a5376b5a36bdfed20d973b301f0f))
-
-
-
-
-
-## [2.18.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.18.2...amplify-category-auth@2.18.3) (2020-08-20)
-
-
-### Bug Fixes
-
-* admin queries typo ([#5038](https://github.com/aws-amplify/amplify-cli/issues/5038)) ([1f37437](https://github.com/aws-amplify/amplify-cli/commit/1f374373061fff59b97e0f7ab3b3b84d1412416e))
-
-
-
-
-
-## [2.18.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.18.1...amplify-category-auth@2.18.2) (2020-08-14)
-
-
-### Bug Fixes
-
-* Added check to stop prompts for cognito triggers while using env commands ([#5039](https://github.com/aws-amplify/amplify-cli/issues/5039)) ([744dbc4](https://github.com/aws-amplify/amplify-cli/commit/744dbc42e847e273160caf3672365391f055191b))
-
-
-
-
-
-## [2.18.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.18.0...amplify-category-auth@2.18.1) (2020-08-11)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-# [2.18.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.16.5...amplify-category-auth@2.18.0) (2020-07-29)
-
-
-### Features
-
-* feature flag implementation ([#4891](https://github.com/aws-amplify/amplify-cli/issues/4891)) ([6d1c632](https://github.com/aws-amplify/amplify-cli/commit/6d1c632952a49cb56670c11c9cb0c3620d0eb332))
-
-
-
-
-
-# [2.17.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.16.5...amplify-category-auth@2.17.0) (2020-07-23)
-
-
-### Features
-
-* feature flag implementation ([#4891](https://github.com/aws-amplify/amplify-cli/issues/4891)) ([4639450](https://github.com/aws-amplify/amplify-cli/commit/463945029cfe861f74986d9a8b9af6b827d2063d))
-
-
-
-
-
-## [2.16.5](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.16.4...amplify-category-auth@2.16.5) (2020-07-18)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.16.4](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.16.3...amplify-category-auth@2.16.4) (2020-07-15)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.16.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.16.2...amplify-category-auth@2.16.3) (2020-07-14)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.16.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.16.1...amplify-category-auth@2.16.2) (2020-07-11)
-
-
-### Bug Fixes
-
-* **cli:** remove unnecessary stack trace log when adding services ([#4610](https://github.com/aws-amplify/amplify-cli/issues/4610)) ([5bee574](https://github.com/aws-amplify/amplify-cli/commit/5bee574bbcd956c032e7714b0813aedd7914a6cb))
-* warning added for identity pool deletion ([#4731](https://github.com/aws-amplify/amplify-cli/issues/4731)) ([d555674](https://github.com/aws-amplify/amplify-cli/commit/d555674e4968cceab6fddd34f1b016dd57d506ea))
-
-
-### Performance Improvements
-
-* fulfill promises to upload files to S3 concurrently ([#4575](https://github.com/aws-amplify/amplify-cli/issues/4575)) ([96d1914](https://github.com/aws-amplify/amplify-cli/commit/96d1914f26507184f14371294d31b3a5e5c94954)), closes [#4158](https://github.com/aws-amplify/amplify-cli/issues/4158)
-
-
-### Reverts
-
-* Revert problematic PRs (#4803) ([7f38d81](https://github.com/aws-amplify/amplify-cli/commit/7f38d81ef2f890c25d39b02407c5255c8760c511)), closes [#4803](https://github.com/aws-amplify/amplify-cli/issues/4803) [#4796](https://github.com/aws-amplify/amplify-cli/issues/4796) [#4576](https://github.com/aws-amplify/amplify-cli/issues/4576) [#4575](https://github.com/aws-amplify/amplify-cli/issues/4575) [#4610](https://github.com/aws-amplify/amplify-cli/issues/4610)
-
-
-
-
-
-## [2.16.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.16.0...amplify-category-auth@2.16.1) (2020-07-09)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-# [2.16.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.15.8...amplify-category-auth@2.16.0) (2020-07-07)
-
-
-### Features
-
-* **cli:** usage measurement ([#3641](https://github.com/aws-amplify/amplify-cli/issues/3641)) ([30a7fe7](https://github.com/aws-amplify/amplify-cli/commit/30a7fe70f5838a766631befcc720a721e801bc5f))
-* Lambda layers ([#4697](https://github.com/aws-amplify/amplify-cli/issues/4697)) ([c55b2e0](https://github.com/aws-amplify/amplify-cli/commit/c55b2e0c3377127aaf887591d7bc20d7240ef11d))
-
-
-
-
-
-## [2.15.8](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.15.7...amplify-category-auth@2.15.8) (2020-06-18)
-
-
-### Bug Fixes
-
-* occurred spelling mistake ([#4595](https://github.com/aws-amplify/amplify-cli/issues/4595)) ([eaf08e0](https://github.com/aws-amplify/amplify-cli/commit/eaf08e00841830e9654fea61ce901f2cb478eebe))
-
-
-
-
-
-## [2.15.7](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.15.6...amplify-category-auth@2.15.7) (2020-05-26)
-
-
-### Bug Fixes
-
-* deleted extra carriageReturn calls, fixed grammar in Auth dx ([#4237](https://github.com/aws-amplify/amplify-cli/issues/4237)) ([4322a32](https://github.com/aws-amplify/amplify-cli/commit/4322a326df8c5c0a89de5f5e8f46bcfd4e1ad770))
-
-
-
-
-
-## [2.15.6](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.15.5...amplify-category-auth@2.15.6) (2020-05-15)
-
-
-### Bug Fixes
-
-* **amplify-category-auth:** adding unique Id to Role name ([#4231](https://github.com/aws-amplify/amplify-cli/issues/4231)) ([21de1af](https://github.com/aws-amplify/amplify-cli/commit/21de1affd89142598a1f8022c387b3c04994b1e0))
-
-
-
-
-
-## [2.15.5](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.15.4...amplify-category-auth@2.15.5) (2020-05-08)
-
-
-### Bug Fixes
-
-* change auth method copy [#4184](https://github.com/aws-amplify/amplify-cli/issues/4184) ([#4198](https://github.com/aws-amplify/amplify-cli/issues/4198)) ([8097671](https://github.com/aws-amplify/amplify-cli/commit/809767143ebf7dd6868279407461d0657e83073a))
-* prevent naming conflicts with new env names ([#3875](https://github.com/aws-amplify/amplify-cli/issues/3875)) ([a7734ae](https://github.com/aws-amplify/amplify-cli/commit/a7734aedb8e846620874ae69e5c38da393dbbe30)), closes [#3854](https://github.com/aws-amplify/amplify-cli/issues/3854)
-
-
-
-
-
-## [2.15.4](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.15.3...amplify-category-auth@2.15.4) (2020-04-06)
-
-
-### Bug Fixes
-
-* **amplify-category-auth:** fixed issue with updating urls in auth ([#3791](https://github.com/aws-amplify/amplify-cli/issues/3791)) ([236cd7a](https://github.com/aws-amplify/amplify-cli/commit/236cd7aecbdc2cbbb0dc9c565aae4e79ff40ebae))
-
-
-
-
-
-## [2.15.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.15.2...amplify-category-auth@2.15.3) (2020-03-22)
-
-
-### Bug Fixes
-
-* enable only-userpool flow without idp and addition of groups without roles tied to idp ([#3662](https://github.com/aws-amplify/amplify-cli/issues/3662)) ([67e0401](https://github.com/aws-amplify/amplify-cli/commit/67e04018d758e617374c4b8ba2298872e728d01e))
-
-
-
-
-
-## [2.15.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.15.1...amplify-category-auth@2.15.2) (2020-03-10)
-
-
-### Bug Fixes
-
-* Fix string literal to be a `Ref` in the cloud formation template ([#3630](https://github.com/aws-amplify/amplify-cli/issues/3630)) ([61e4ac9](https://github.com/aws-amplify/amplify-cli/commit/61e4ac95acc728c46440927c79c158b35abe0e39))
-
-
-
-
-
-## [2.15.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.13.3...amplify-category-auth@2.15.1) (2020-03-07)
-
-
-### Bug Fixes
-
-* scoping down user pool group IAM roles and adding --force to amplify push command ([#3609](https://github.com/aws-amplify/amplify-cli/issues/3609)) ([2e10a2f](https://github.com/aws-amplify/amplify-cli/commit/2e10a2ff62b61f57b2d513a7cfd0e4478f429f1f))
-
-
-
-
-
-## [2.14.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.13.5-beta.0...amplify-category-auth@2.14.1) (2020-03-05)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.13.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.13.2...amplify-category-auth@2.13.3) (2020-02-13)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.13.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.13.1...amplify-category-auth@2.13.2) (2020-02-07)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-## [2.13.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@2.13.0...amplify-category-auth@2.13.1) (2020-01-24)
-
-**Note:** Version bump only for package amplify-category-auth
-
-
-
-
-
-# [2.13.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.30.0...amplify-category-auth@2.13.0) (2020-01-23)
-
-### Bug Fixes
-
-- randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-- **amplify-cli:** updating path in trigger indexes for node10 ([c4b1082](https://github.com/aws-amplify/amplify-cli/commit/c4b10820232e614a2951d840a6307031df73aebd)), closes [#3083](https://github.com/aws-amplify/amplify-cli/issues/3083)
-
-### Features
-
-- Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-- **amplify-category-auth:** export lambda trigger roles in template ([#2894](https://github.com/aws-amplify/amplify-cli/issues/2894)) ([3d07717](https://github.com/aws-amplify/amplify-cli/commit/3d077179c28db7e2c8114bd88f27c99b08062313)), closes [#2303](https://github.com/aws-amplify/amplify-cli/issues/2303)
-- **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-
-# [2.12.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.30.0...amplify-category-auth@2.12.0) (2020-01-09)
-
-### Bug Fixes
-
-- randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-- **amplify-cli:** updating path in trigger indexes for node10 ([c4b1082](https://github.com/aws-amplify/amplify-cli/commit/c4b10820232e614a2951d840a6307031df73aebd)), closes [#3083](https://github.com/aws-amplify/amplify-cli/issues/3083)
-
-### Features
-
-- Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-- **amplify-category-auth:** export lambda trigger roles in template ([#2894](https://github.com/aws-amplify/amplify-cli/issues/2894)) ([3d07717](https://github.com/aws-amplify/amplify-cli/commit/3d077179c28db7e2c8114bd88f27c99b08062313)), closes [#2303](https://github.com/aws-amplify/amplify-cli/issues/2303)
-- **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-
-# [2.11.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.30.0...amplify-category-auth@2.11.0) (2019-12-31)
-
-### Bug Fixes
-
-- randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-- **amplify-cli:** updating path in trigger indexes for node10 ([c4b1082](https://github.com/aws-amplify/amplify-cli/commit/c4b10820232e614a2951d840a6307031df73aebd)), closes [#3083](https://github.com/aws-amplify/amplify-cli/issues/3083)
-
-### Features
-
-- Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-- **amplify-category-auth:** export lambda trigger roles in template ([#2894](https://github.com/aws-amplify/amplify-cli/issues/2894)) ([3d07717](https://github.com/aws-amplify/amplify-cli/commit/3d077179c28db7e2c8114bd88f27c99b08062313)), closes [#2303](https://github.com/aws-amplify/amplify-cli/issues/2303)
-- **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-
-# [2.10.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.30.0...amplify-category-auth@2.10.0) (2019-12-28)
-
-### Bug Fixes
-
-- randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-- **amplify-cli:** updating path in trigger indexes for node10 ([c4b1082](https://github.com/aws-amplify/amplify-cli/commit/c4b10820232e614a2951d840a6307031df73aebd)), closes [#3083](https://github.com/aws-amplify/amplify-cli/issues/3083)
-
-### Features
-
-- Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-- **amplify-category-auth:** export lambda trigger roles in template ([#2894](https://github.com/aws-amplify/amplify-cli/issues/2894)) ([3d07717](https://github.com/aws-amplify/amplify-cli/commit/3d077179c28db7e2c8114bd88f27c99b08062313)), closes [#2303](https://github.com/aws-amplify/amplify-cli/issues/2303)
-- **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-
-# [2.9.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.30.0...amplify-category-auth@2.9.0) (2019-12-26)
-
-### Bug Fixes
-
-- randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-
-### Features
-
-- Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-- **amplify-category-auth:** export lambda trigger roles in template ([#2894](https://github.com/aws-amplify/amplify-cli/issues/2894)) ([3d07717](https://github.com/aws-amplify/amplify-cli/commit/3d077179c28db7e2c8114bd88f27c99b08062313)), closes [#2303](https://github.com/aws-amplify/amplify-cli/issues/2303)
-- **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-
-# [2.8.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.30.0...amplify-category-auth@2.8.0) (2019-12-25)
-
-### Bug Fixes
-
-- randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-
-### Features
-
-- Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-- **amplify-category-auth:** export lambda trigger roles in template ([#2894](https://github.com/aws-amplify/amplify-cli/issues/2894)) ([3d07717](https://github.com/aws-amplify/amplify-cli/commit/3d077179c28db7e2c8114bd88f27c99b08062313)), closes [#2303](https://github.com/aws-amplify/amplify-cli/issues/2303)
-- **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-
-# [2.7.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.30.0...amplify-category-auth@2.7.0) (2019-12-20)
-
-### Bug Fixes
-
-- randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-
-### Features
-
-- Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-- **amplify-category-auth:** export lambda trigger roles in template ([#2894](https://github.com/aws-amplify/amplify-cli/issues/2894)) ([3d07717](https://github.com/aws-amplify/amplify-cli/commit/3d077179c28db7e2c8114bd88f27c99b08062313)), closes [#2303](https://github.com/aws-amplify/amplify-cli/issues/2303)
-- **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-
-# [2.6.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.30.0...amplify-category-auth@2.6.0) (2019-12-10)
-
-### Bug Fixes
-
-- randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-
-### Features
-
-- Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-- **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-
-# [2.4.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.30.0...amplify-category-auth@2.4.0) (2019-12-03)
-
-### Bug Fixes
-
-- randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-
-### Features
-
-- Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-- **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-
-# [2.3.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.30.0...amplify-category-auth@2.3.0) (2019-12-01)
-
-### Bug Fixes
-
-- randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-
-### Features
-
-- Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-- **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-
-# [2.2.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.30.0...amplify-category-auth@2.2.0) (2019-11-27)
-
-### Bug Fixes
-
-- randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-
-### Features
-
-- Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-- **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-
-# [2.1.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.30.0...amplify-category-auth@2.1.0) (2019-11-27)
-
-### Bug Fixes
-
-- randomize role-names and bucket-name for auth and storage category ([#2709](https://github.com/aws-amplify/amplify-cli/issues/2709)) ([fe0e979](https://github.com/aws-amplify/amplify-cli/commit/fe0e979812bd3142a56a62bf15444cbb3dbbb6bb))
-
-### Features
-
-- Delete all ([#2615](https://github.com/aws-amplify/amplify-cli/issues/2615)) ([5467679](https://github.com/aws-amplify/amplify-cli/commit/54676797b913d4a2c284c62244c8ccf8e55a44d8))
-- **cli:** cLI updates and new features for Amplify Console ([#2742](https://github.com/aws-amplify/amplify-cli/issues/2742)) ([0fd0dd5](https://github.com/aws-amplify/amplify-cli/commit/0fd0dd5102177766c454c8715fa5acac32385048))
-
-# [1.13.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.7.3...amplify-category-auth@1.13.0) (2019-08-30)
-
-### Bug Fixes
-
-- **amplify-category-auth:** consolidates parameters below limit ([#1948](https://github.com/aws-amplify/amplify-cli/issues/1948)) ([3cdbad8](https://github.com/aws-amplify/amplify-cli/commit/3cdbad8))
-- [#1056](https://github.com/aws-amplify/amplify-cli/issues/1056), dedup environment file reading ([#2088](https://github.com/aws-amplify/amplify-cli/issues/2088)) ([940deaa](https://github.com/aws-amplify/amplify-cli/commit/940deaa))
-- [#429](https://github.com/aws-amplify/amplify-cli/issues/429) - Editor hanging bug ([#2086](https://github.com/aws-amplify/amplify-cli/issues/2086)) ([6767445](https://github.com/aws-amplify/amplify-cli/commit/6767445))
-- move test package dependencies to devDependencies ([#2034](https://github.com/aws-amplify/amplify-cli/issues/2034)) ([f5623d0](https://github.com/aws-amplify/amplify-cli/commit/f5623d0))
-
-### Features
-
-- adding amplify cli predictions category ([#1936](https://github.com/aws-amplify/amplify-cli/issues/1936)) ([b7b7c2c](https://github.com/aws-amplify/amplify-cli/commit/b7b7c2c))
-
-# [1.12.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.7.3...amplify-category-auth@1.12.0) (2019-08-28)
-
-### Bug Fixes
-
-- **amplify-category-auth:** consolidates parameters below limit ([#1948](https://github.com/aws-amplify/amplify-cli/issues/1948)) ([3cdbad8](https://github.com/aws-amplify/amplify-cli/commit/3cdbad8))
-- [#1056](https://github.com/aws-amplify/amplify-cli/issues/1056), dedup environment file reading ([#2088](https://github.com/aws-amplify/amplify-cli/issues/2088)) ([940deaa](https://github.com/aws-amplify/amplify-cli/commit/940deaa))
-- [#429](https://github.com/aws-amplify/amplify-cli/issues/429) - Editor hanging bug ([#2086](https://github.com/aws-amplify/amplify-cli/issues/2086)) ([6767445](https://github.com/aws-amplify/amplify-cli/commit/6767445))
-- move test package dependencies to devDependencies ([#2034](https://github.com/aws-amplify/amplify-cli/issues/2034)) ([f5623d0](https://github.com/aws-amplify/amplify-cli/commit/f5623d0))
-
-### Features
-
-- adding amplify cli predictions category ([#1936](https://github.com/aws-amplify/amplify-cli/issues/1936)) ([b7b7c2c](https://github.com/aws-amplify/amplify-cli/commit/b7b7c2c))
-
-# [1.11.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.7.3...amplify-category-auth@1.11.0) (2019-08-13)
-
-### Bug Fixes
-
-- **amplify-category-auth:** consolidates parameters below limit ([#1948](https://github.com/aws-amplify/amplify-cli/issues/1948)) ([3cdbad8](https://github.com/aws-amplify/amplify-cli/commit/3cdbad8))
-
-### Features
-
-- adding amplify cli predictions category ([#1936](https://github.com/aws-amplify/amplify-cli/issues/1936)) ([b7b7c2c](https://github.com/aws-amplify/amplify-cli/commit/b7b7c2c))
-
-# [1.10.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.7.3...amplify-category-auth@1.10.0) (2019-08-07)
-
-### Bug Fixes
-
-- **amplify-category-auth:** consolidates parameters below limit ([#1948](https://github.com/aws-amplify/amplify-cli/issues/1948)) ([3cdbad8](https://github.com/aws-amplify/amplify-cli/commit/3cdbad8))
-
-### Features
-
-- adding amplify cli predictions category ([#1936](https://github.com/aws-amplify/amplify-cli/issues/1936)) ([b7b7c2c](https://github.com/aws-amplify/amplify-cli/commit/b7b7c2c))
-
-# [1.9.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.7.3...amplify-category-auth@1.9.0) (2019-08-02)
-
-### Features
-
-- adding amplify cli predictions category ([#1936](https://github.com/aws-amplify/amplify-cli/issues/1936)) ([b7b7c2c](https://github.com/aws-amplify/amplify-cli/commit/b7b7c2c))
-
-# [1.8.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.7.3...amplify-category-auth@1.8.0) (2019-07-31)
-
-### Features
-
-- adding amplify cli predictions category ([#1936](https://github.com/aws-amplify/amplify-cli/issues/1936)) ([b7b7c2c](https://github.com/aws-amplify/amplify-cli/commit/b7b7c2c))
-
-## [1.7.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.7.1...amplify-category-auth@1.7.3) (2019-07-23)
-
-### Bug Fixes
-
-- **amplify-category-auth:** adding PreAuthentication trigger ([42ee201](https://github.com/aws-amplify/amplify-cli/commit/42ee201)), closes [#1838](https://github.com/aws-amplify/amplify-cli/issues/1838)
-
-## [1.7.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.7.0...amplify-category-auth@1.7.1) (2019-07-10)
-
-**Note:** Version bump only for package amplify-category-auth
-
-# [1.7.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.6.3...amplify-category-auth@1.7.0) (2019-07-09)
-
-### Bug Fixes
-
-- replacing rel paths with plugin func ([71f553f](https://github.com/aws-amplify/amplify-cli/commit/71f553f))
-
-### Features
-
-- cognito + s3 + dyanmodb lambda trigger support ([#1783](https://github.com/aws-amplify/amplify-cli/issues/1783)) ([c6fc838](https://github.com/aws-amplify/amplify-cli/commit/c6fc838))
-
-## [1.6.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.6.2...amplify-category-auth@1.6.3) (2019-06-20)
-
-### Bug Fixes
-
-- **cli:** fix inquirer version ([#1690](https://github.com/aws-amplify/amplify-cli/issues/1690)) ([9246032](https://github.com/aws-amplify/amplify-cli/commit/9246032)), closes [#1688](https://github.com/aws-amplify/amplify-cli/issues/1688)
-
-## [1.6.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.6.1...amplify-category-auth@1.6.2) (2019-06-11)
-
-### Bug Fixes
-
-- **amplify-category-auth:** provide correct arn in permission policies ([#1610](https://github.com/aws-amplify/amplify-cli/issues/1610)) ([27fd157](https://github.com/aws-amplify/amplify-cli/commit/27fd157))
-
-## [1.6.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.6.0...amplify-category-auth@1.6.1) (2019-06-06)
-
-### Bug Fixes
-
-- **amplify-category-auth:** fix domain reserved words ([#1544](https://github.com/aws-amplify/amplify-cli/issues/1544)) ([31d4a89](https://github.com/aws-amplify/amplify-cli/commit/31d4a89)), closes [#1513](https://github.com/aws-amplify/amplify-cli/issues/1513)
-
-# [1.6.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.5.6...amplify-category-auth@1.6.0) (2019-05-29)
-
-### Bug Fixes
-
-- **amplify-category-auth:** match cognito token expiration date range ([eb4c9ee](https://github.com/aws-amplify/amplify-cli/commit/eb4c9ee)), closes [#1385](https://github.com/aws-amplify/amplify-cli/issues/1385)
-
-### Features
-
-- flow to add policies to access amplify resources from Lambda ([#1462](https://github.com/aws-amplify/amplify-cli/issues/1462)) ([fee247c](https://github.com/aws-amplify/amplify-cli/commit/fee247c))
-
-## [1.5.6](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.5.5...amplify-category-auth@1.5.6) (2019-05-21)
-
-### Bug Fixes
-
-- **amplify-category-auth:** add policy name char length limit ([#1492](https://github.com/aws-amplify/amplify-cli/issues/1492)) ([d6a8785](https://github.com/aws-amplify/amplify-cli/commit/d6a8785)), closes [#1199](https://github.com/aws-amplify/amplify-cli/issues/1199)
-
-## [1.5.5](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.5.4...amplify-category-auth@1.5.5) (2019-05-17)
-
-### Bug Fixes
-
-- fixes [#1471](https://github.com/aws-amplify/amplify-cli/issues/1471) ([52b26cb](https://github.com/aws-amplify/amplify-cli/commit/52b26cb))
-
-## [1.5.4](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.5.3...amplify-category-auth@1.5.4) (2019-04-30)
-
-### Bug Fixes
-
-- update CLI to handle UTF8 BOM ([#1357](https://github.com/aws-amplify/amplify-cli/issues/1357)) ([b0afa07](https://github.com/aws-amplify/amplify-cli/commit/b0afa07)), closes [#1355](https://github.com/aws-amplify/amplify-cli/issues/1355) [#1122](https://github.com/aws-amplify/amplify-cli/issues/1122)
-
-## [1.5.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.5.2...amplify-category-auth@1.5.3) (2019-04-25)
-
-### Bug Fixes
-
-- **amplify-category-auth:** uses public_profile for FB scopes ([c9af7b7](https://github.com/aws-amplify/amplify-cli/commit/c9af7b7)), closes [#1335](https://github.com/aws-amplify/amplify-cli/issues/1335)
-
-## [1.5.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.5.1...amplify-category-auth@1.5.2) (2019-04-16)
-
-### Bug Fixes
-
-- fix [#1254](https://github.com/aws-amplify/amplify-cli/issues/1254) ([0962650](https://github.com/aws-amplify/amplify-cli/commit/0962650))
-- **amplify-category-auth:** fixes cloudformation template ([706de43](https://github.com/aws-amplify/amplify-cli/commit/706de43)), closes [#1247](https://github.com/aws-amplify/amplify-cli/issues/1247)
-- fix [#1264](https://github.com/aws-amplify/amplify-cli/issues/1264) ([d901daf](https://github.com/aws-amplify/amplify-cli/commit/d901daf))
-
-## [1.5.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.4.0...amplify-category-auth@1.5.1) (2019-04-09)
-
-**Note:** Version bump only for package amplify-category-auth
-
-# [1.4.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.0.7...amplify-category-auth@1.4.0) (2019-04-03)
-
-### Bug Fixes
-
-- fix redirect URI regex ([eaec6c2](https://github.com/aws-amplify/amplify-cli/commit/eaec6c2))
-
-### Features
-
-- support for provisioning Cognito Hosted UI and support CRUD operations in Storage and API categories ([729b0de](https://github.com/aws-amplify/amplify-cli/commit/729b0de))
-
-## [1.0.7](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.0.6...amplify-category-auth@1.0.7) (2019-03-22)
-
-### Bug Fixes
-
-- **amplify-category-auth:** use right response signal of cfn-response ([572ca45](https://github.com/aws-amplify/amplify-cli/commit/572ca45))
-
-## [1.0.6](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.0.5...amplify-category-auth@1.0.6) (2019-02-26)
-
-### Bug Fixes
-
-- **amplify-category-auth:** update auth cfn template to quote string ([1ff9e16](https://github.com/aws-amplify/amplify-cli/commit/1ff9e16)), closes [#882](https://github.com/aws-amplify/amplify-cli/issues/882)
-
-## [1.0.5](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.0.3-beta.0...amplify-category-auth@1.0.5) (2019-02-11)
-
-**Note:** Version bump only for package amplify-category-auth
-
-## [1.0.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.0.3-beta.0...amplify-category-auth@1.0.3) (2019-02-11)
-
-**Note:** Version bump only for package amplify-category-auth
-
-## [1.0.3-beta.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@1.0.2...amplify-category-auth@1.0.3-beta.0) (2019-02-11)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.2.1-multienv.4"></a>
-
-## [0.2.1-multienv.4](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.2.1-multienv.3...amplify-category-auth@0.2.1-multienv.4) (2019-01-30)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.2.1-multienv.3"></a>
-
-## [0.2.1-multienv.3](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.2.1-multienv.2...amplify-category-auth@0.2.1-multienv.3) (2018-12-28)
-
-### Features
-
-- **amplify-category-auth:** console ([#636](https://github.com/aws-amplify/amplify-cli/issues/636)) ([dea38aa](https://github.com/aws-amplify/amplify-cli/commit/dea38aa))
-
-<a name="0.2.1-multienv.2"></a>
-
-## [0.2.1-multienv.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.2.1-multienv.1...amplify-category-auth@0.2.1-multienv.2) (2018-12-21)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.2.1-multienv.1"></a>
-
-## [0.2.1-multienv.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.2.1-multienv.0...amplify-category-auth@0.2.1-multienv.1) (2018-11-28)
-
-### Features
-
-- Multienv auth migrate ([#498](https://github.com/aws-amplify/amplify-cli/issues/498)) ([ef3e3b3](https://github.com/aws-amplify/amplify-cli/commit/ef3e3b3))
-
-<a name="0.2.1-multienv.0"></a>
-
-## [0.2.1-multienv.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.34-multienv.2...amplify-category-auth@0.2.1-multienv.0) (2018-11-21)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.34-multienv.2"></a>
-
-## [0.1.34-multienv.2](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.34-multienv.1...amplify-category-auth@0.1.34-multienv.2) (2018-11-19)
-
-### Bug Fixes
-
-- **amplify-category-auth:** get env specific data in externalAuthEnable ([#473](https://github.com/aws-amplify/amplify-cli/issues/473)) ([6aa66cb](https://github.com/aws-amplify/amplify-cli/commit/6aa66cb))
-
-<a name="0.1.34-multienv.1"></a>
-
-## [0.1.34-multienv.1](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.34-multienv.0...amplify-category-auth@0.1.34-multienv.1) (2018-11-19)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.34-multienv.0"></a>
-
-## [0.1.34-multienv.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.33...amplify-category-auth@0.1.34-multienv.0) (2018-11-16)
-
-### Features
-
-- headless Init and configure ([#371](https://github.com/aws-amplify/amplify-cli/issues/371)) ([acd14a8](https://github.com/aws-amplify/amplify-cli/commit/acd14a8))
-- headless Init and configure ([#371](https://github.com/aws-amplify/amplify-cli/issues/371)) ([8780400](https://github.com/aws-amplify/amplify-cli/commit/8780400))
-- **amplify-category-auth:** add headless init support for auth ([#465](https://github.com/aws-amplify/amplify-cli/issues/465)) ([18410f2](https://github.com/aws-amplify/amplify-cli/commit/18410f2))
-
-<a name="0.1.33"></a>
-
-## [0.1.33](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.33-beta.0...amplify-category-auth@0.1.33) (2018-11-09)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.33-beta.0"></a>
-
-## [0.1.33-beta.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.13...amplify-category-auth@0.1.33-beta.0) (2018-11-09)
-
-### Bug Fixes
-
-- **amplify-category-auth:** Fix auth add not found on Windows. ([d9202fe](https://github.com/aws-amplify/amplify-cli/commit/d9202fe))
-
-<a name="0.1.32"></a>
-
-## [0.1.32](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.32-beta.0...amplify-category-auth@0.1.32) (2018-11-05)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.32-beta.0"></a>
-
-## [0.1.32-beta.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.13...amplify-category-auth@0.1.32-beta.0) (2018-11-05)
-
-### Bug Fixes
-
-- **amplify-category-auth:** Fix auth add not found on Windows. ([d9202fe](https://github.com/aws-amplify/amplify-cli/commit/d9202fe))
-
-<a name="0.1.31"></a>
-
-## [0.1.31](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.13...amplify-category-auth@0.1.31) (2018-11-02)
-
-### Bug Fixes
-
-- **amplify-category-auth:** Fix auth add not found on Windows. ([d9202fe](https://github.com/aws-amplify/amplify-cli/commit/d9202fe))
-
-<a name="0.1.30"></a>
-
-## [0.1.30](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.30-beta.0...amplify-category-auth@0.1.30) (2018-11-02)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.30-beta.0"></a>
-
-## [0.1.30-beta.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.13...amplify-category-auth@0.1.30-beta.0) (2018-11-02)
-
-### Bug Fixes
-
-- **amplify-category-auth:** Fix auth add not found on Windows. ([d9202fe](https://github.com/aws-amplify/amplify-cli/commit/d9202fe))
-
-<a name="0.1.29"></a>
-
-## [0.1.29](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.29-beta.0...amplify-category-auth@0.1.29) (2018-10-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.29-beta.0"></a>
-
-## [0.1.29-beta.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.13...amplify-category-auth@0.1.29-beta.0) (2018-10-23)
-
-### Bug Fixes
-
-- **amplify-category-auth:** Fix auth add not found on Windows. ([d9202fe](https://github.com/aws-amplify/amplify-cli/commit/d9202fe))
-
-<a name="0.1.28"></a>
-
-## [0.1.28](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.28-beta.0...amplify-category-auth@0.1.28) (2018-10-18)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.28-beta.0"></a>
-
-## [0.1.28-beta.0](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.13...amplify-category-auth@0.1.28-beta.0) (2018-10-12)
-
-### Bug Fixes
-
-- **amplify-category-auth:** Fix auth add not found on Windows. ([d9202fe](https://github.com/aws-amplify/amplify-cli/commit/d9202fe))
-
-<a name="0.1.13"></a>
-
-## [0.1.13](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.12...amplify-category-auth@0.1.13) (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.12"></a>
-
-## [0.1.12](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.11...amplify-category-auth@0.1.12) (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.11"></a>
-
-## [0.1.11](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.9...amplify-category-auth@0.1.11) (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.10"></a>
-
-## [0.1.10](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.9...amplify-category-auth@0.1.10) (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.9"></a>
-
-## [0.1.9](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.8...amplify-category-auth@0.1.9) (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.8"></a>
-
-## [0.1.8](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.7...amplify-category-auth@0.1.8) (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.7"></a>
-
-## [0.1.7](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.6...amplify-category-auth@0.1.7) (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.6"></a>
-
-## [0.1.6](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.5...amplify-category-auth@0.1.6) (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.5"></a>
-
-## [0.1.5](https://github.com/aws-amplify/amplify-cli/compare/amplify-category-auth@0.1.4...amplify-category-auth@0.1.5) (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.4"></a>
-
-## 0.1.4 (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.3"></a>
-
-## 0.1.3 (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.2"></a>
-
-## 0.1.2 (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
-
-<a name="0.1.1"></a>
-
-## 0.1.1 (2018-08-23)
-
-**Note:** Version bump only for package amplify-category-auth
diff --git a/packages/amplify-category-auth/Readme.md b/packages/amplify-category-auth/Readme.md
index 180a7cd18d1..8161befe28c 100644
--- a/packages/amplify-category-auth/Readme.md
+++ b/packages/amplify-category-auth/Readme.md
@@ -4,8 +4,8 @@
 
 The current set of commands supported by the Amplify Auth Category Plugin
 
-| Command              | Description |
-| --- | --- |
-| amplify auth add | Takes you through steps in the CLI to add an Auth resource to your backend.   |
-| amplify auth push | Provisions only Auth cloud resources with the latest local developments.  |
+| Command             | Description                                                                                                     |
+| ------------------- | --------------------------------------------------------------------------------------------------------------- |
+| amplify auth add    | Takes you through steps in the CLI to add an Auth resource to your backend.                                     |
+| amplify auth push   | Provisions only Auth cloud resources with the latest local developments.                                        |
 | amplify auth remove | Removes Auth resource from your local backend. The resource is removed from the cloud on the next push command. |
diff --git a/packages/amplify-category-auth/amplify-plugin.json b/packages/amplify-category-auth/amplify-plugin.json
index 0976ce97e37..4c1f7e5a6ec 100644
--- a/packages/amplify-category-auth/amplify-plugin.json
+++ b/packages/amplify-category-auth/amplify-plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "auth",
   "type": "category",
-  "commands": ["add", "console", "enable", "import", "push", "remove", "update", "help"],
+  "commands": ["add", "console", "enable", "import", "push", "remove", "update", "help", "override"],
   "eventHandlers": []
 }
diff --git a/packages/amplify-category-auth/package.json b/packages/amplify-category-auth/package.json
index 4a8265e158a..d967704c858 100644
--- a/packages/amplify-category-auth/package.json
+++ b/packages/amplify-category-auth/package.json
@@ -1,6 +1,6 @@
 {
-  "name": "amplify-category-auth",
-  "version": "2.38.1",
+  "name": "@aws-amplify/amplify-category-auth",
+  "version": "1.0.0",
   "description": "amplify-cli authentication plugin",
   "repository": {
     "type": "git",
@@ -20,7 +20,8 @@
     "watch": "tsc -w",
     "clean": "rimraf lib tsconfig.tsbuildinfo",
     "test": "jest",
-    "test-watch": "jest --watch"
+    "test-watch": "jest --watch",
+    "generateSchemas": "ts-node ./scripts/generateAuthSchemas.ts"
   },
   "dependencies": {
     "amplify-cli-core": "1.29.0",
@@ -38,7 +39,8 @@
     "mime-types": "^2.1.26",
     "ora": "^4.0.3",
     "promise-sequential": "^1.1.1",
-    "uuid": "^3.4.0"
+    "uuid": "^3.4.0",
+    "vm2": "^3.9.3"
   },
   "devDependencies": {
     "rimraf": "^3.0.2"
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CreateAuthChallenge/function-template-dir/event.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CreateAuthChallenge/function-template-dir/event.json
index e7cf98603e0..fd2722e8599 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CreateAuthChallenge/function-template-dir/event.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CreateAuthChallenge/function-template-dir/event.json
@@ -1,5 +1,5 @@
 {
-    "key1": "value1",
-    "key2": "value2",
-    "key3": "value3"
-}
\ No newline at end of file
+  "key1": "value1",
+  "key2": "value2",
+  "key3": "value3"
+}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/CustomMessage.map.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/CustomMessage.map.json
index 1e0fbe2c3b3..bc23c74929e 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/CustomMessage.map.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/CustomMessage.map.json
@@ -11,7 +11,7 @@
         "key": "REDIRECTURL",
         "value": "askUser",
         "question": {
-          "name" : "REDIRECTURL",
+          "name": "REDIRECTURL",
           "type": "input",
           "message": "Enter the URL that your users will be redirected to upon account confirmation:"
         }
@@ -20,7 +20,7 @@
         "key": "EMAILSUBJECT",
         "value": "askUser",
         "question": {
-          "name" : "EMAILSUBJECT",
+          "name": "EMAILSUBJECT",
           "type": "input",
           "message": "Enter the subject for your custom account confirmation email:"
         }
@@ -29,7 +29,7 @@
         "key": "EMAILMESSAGE",
         "value": "askUser",
         "question": {
-          "name" : "EMAILMESSAGE",
+          "name": "EMAILMESSAGE",
           "type": "input",
           "message": "Enter the body text for your custom account confirmation email (this will appear before the link URL):"
         }
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/index.html b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/index.html
index 41256473ca4..8199de1e801 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/index.html
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/index.html
@@ -1,12 +1,10 @@
 <!DOCTYPE html>
 <html>
   <head>
-    <meta charset="UTF-8">
+    <meta charset="UTF-8" />
     <title>AWS SDK for JavaScript - Browser Getting Started Application</title>
-    <link rel="stylesheet" type="text/css" href="style.css">
-
+    <link rel="stylesheet" type="text/css" href="style.css" />
   </head>
- 
 
   <body>
     <div>
@@ -16,9 +14,9 @@
     <script src="./spinner.js" type="text/javascript"></script>
     <script src="./verify.js" type="text/javascript"></script>
     <script type="text/javascript">
-        window.onload = function() {
-            confirm();
-        };
+      window.onload = function () {
+        confirm();
+      };
     </script>
   </body>
 </html>
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/spinner.js b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/spinner.js
index b3ffe21ab19..2a934b85519 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/spinner.js
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/spinner.js
@@ -1,10 +1,10 @@
 /* eslint-disable */
 var __assign =
   (this && this.__assign) ||
-  function() {
+  function () {
     __assign =
       Object.assign ||
-      function(t) {
+      function (t) {
         for (var s, i = 1, n = arguments.length; i < n; i++) {
           s = arguments[i];
           for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p)) t[p] = s[p];
@@ -33,7 +33,7 @@ var defaults = {
   shadow: '0 0 1px transparent',
   position: 'absolute',
 };
-var Spinner = /** @class */ (function() {
+var Spinner = /** @class */ (function () {
   function Spinner(opts) {
     if (opts === void 0) {
       opts = {};
@@ -45,7 +45,7 @@ var Spinner = /** @class */ (function() {
    * spinning, it is automatically removed from its previous target by calling
    * stop() internally.
    */
-  Spinner.prototype.spin = function(target) {
+  Spinner.prototype.spin = function (target) {
     this.stop();
     this.el = document.createElement('div');
     this.el.className = this.opts.className;
@@ -68,7 +68,7 @@ var Spinner = /** @class */ (function() {
    * Stops and removes the Spinner.
    * Stopped spinners may be reused by calling spin() again.
    */
-  Spinner.prototype.stop = function() {
+  Spinner.prototype.stop = function () {
     if (this.el) {
       if (typeof requestAnimationFrame !== 'undefined') {
         cancelAnimationFrame(this.animateId);
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/style.css b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/style.css
index 8cf30e31289..4ce77a962e4 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/style.css
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/style.css
@@ -1,5 +1,6 @@
 @keyframes spinner-line-fade-more {
-  0%, 100% {
+  0%,
+  100% {
     opacity: 0; /* minimum opacity */
   }
   1% {
@@ -7,7 +8,9 @@
   }
 }
 @keyframes spinner-line-fade-quick {
-  0%, 39%, 100% {
+  0%,
+  39%,
+  100% {
     opacity: 0.25; /* minimum opacity */
   }
   40% {
@@ -15,10 +18,11 @@
   }
 }
 @keyframes spinner-line-fade-default {
-  0%, 100% {
+  0%,
+  100% {
     opacity: 0.22; /* minimum opacity */
   }
   1% {
     opacity: 1;
   }
-}
\ No newline at end of file
+}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/verify.js b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/verify.js
index 8463ff05f44..88bb9c6fab2 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/verify.js
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/assets/verify.js
@@ -41,7 +41,7 @@ function confirm() {
 
   var cognitoidentityserviceprovider = new AWS.CognitoIdentityServiceProvider();
 
-  cognitoidentityserviceprovider.confirmSignUp(params, function(err, data) {
+  cognitoidentityserviceprovider.confirmSignUp(params, function (err, data) {
     if (err) {
       if (err.message === 'User cannot be confirm. Current status is CONFIRMED') {
         window.location.replace(redirectUrl);
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/function-template-dir/event.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/function-template-dir/event.json
index 63a6031279a..7822b02bb91 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/function-template-dir/event.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/CustomMessage/function-template-dir/event.json
@@ -1,12 +1,12 @@
 {
-    "region": "us-west-2",
-    "callerContext": {
+  "region": "us-west-2",
+  "callerContext": {
     "clientId": "dummyId"
-    },
-    "userName": "testUser",
-    "triggerSource": "CustomMessage_SignUp",
-    "request": {
+  },
+  "userName": "testUser",
+  "triggerSource": "CustomMessage_SignUp",
+  "request": {
     "codeParameter": "0000"
-    },
-    "response": {}
-  }
\ No newline at end of file
+  },
+  "response": {}
+}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/DefineAuthChallenge/DefineAuthChallenge.map.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/DefineAuthChallenge/DefineAuthChallenge.map.json
index fc39bec25fb..f0652b13b78 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/DefineAuthChallenge/DefineAuthChallenge.map.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/DefineAuthChallenge/DefineAuthChallenge.map.json
@@ -7,4 +7,4 @@
     "name": "Custom Auth Challenge Scaffolding (Definition)",
     "description": "1 of 3 triggers needed to set-up the basic scaffolding for a custom authentication flow.  Please note that this scaffolding should be built out using your desired functionality before being used in production."
   }
-}
\ No newline at end of file
+}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/DefineAuthChallenge/function-template-dir/event.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/DefineAuthChallenge/function-template-dir/event.json
index e7cf98603e0..fd2722e8599 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/DefineAuthChallenge/function-template-dir/event.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/DefineAuthChallenge/function-template-dir/event.json
@@ -1,5 +1,5 @@
 {
-    "key1": "value1",
-    "key2": "value2",
-    "key3": "value3"
-}
\ No newline at end of file
+  "key1": "value1",
+  "key2": "value2",
+  "key3": "value3"
+}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostAuthentication/PostAuthentication.map.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostAuthentication/PostAuthentication.map.json
index 0e0dcd235c4..0967ef424bc 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostAuthentication/PostAuthentication.map.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostAuthentication/PostAuthentication.map.json
@@ -1,3 +1 @@
-{
-
-}
\ No newline at end of file
+{}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostAuthentication/function-template-dir/event.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostAuthentication/function-template-dir/event.json
index e7cf98603e0..fd2722e8599 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostAuthentication/function-template-dir/event.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostAuthentication/function-template-dir/event.json
@@ -1,5 +1,5 @@
 {
-    "key1": "value1",
-    "key2": "value2",
-    "key3": "value3"
-}
\ No newline at end of file
+  "key1": "value1",
+  "key2": "value2",
+  "key3": "value3"
+}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostConfirmation/PostConfirmation.map.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostConfirmation/PostConfirmation.map.json
index ba32933219d..b219132885c 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostConfirmation/PostConfirmation.map.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostConfirmation/PostConfirmation.map.json
@@ -19,11 +19,11 @@
         "key": "GROUP",
         "value": "askUser",
         "question": {
-          "name" : "GROUP",
+          "name": "GROUP",
           "type": "input",
           "message": "Enter the name of the group to which users will be added."
         }
       }
     ]
   }
-}
\ No newline at end of file
+}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostConfirmation/function-template-dir/event.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostConfirmation/function-template-dir/event.json
index 3ad39eb3466..5eafe06ea53 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostConfirmation/function-template-dir/event.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PostConfirmation/function-template-dir/event.json
@@ -1,7 +1,7 @@
 {
-    "request": {
-        "userPoolId": "testID",
-        "userName": "testUser"
-    },
-    "response": {}
-}
\ No newline at end of file
+  "request": {
+    "userPoolId": "testID",
+    "userName": "testUser"
+  },
+  "response": {}
+}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PreAuthentication/PreAuthentication.map.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PreAuthentication/PreAuthentication.map.json
index 0db3279e44b..0967ef424bc 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PreAuthentication/PreAuthentication.map.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PreAuthentication/PreAuthentication.map.json
@@ -1,3 +1 @@
-{
-
-}
+{}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PreSignup/function-template-dir/event.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PreSignup/function-template-dir/event.json
index a44bae6da24..ee8d975ed58 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PreSignup/function-template-dir/event.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/PreSignup/function-template-dir/event.json
@@ -1,8 +1,8 @@
 {
-    "request": {
-      "userAttributes": {
-        "email": "testEmail@domain.com"
-      }
-    },
-    "response": {}
-}
\ No newline at end of file
+  "request": {
+    "userAttributes": {
+      "email": "testEmail@domain.com"
+    }
+  },
+  "response": {}
+}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/VerifyAuthChallengeResponse/VerifyAuthChallengeResponse.map.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/VerifyAuthChallengeResponse/VerifyAuthChallengeResponse.map.json
index f4864eac0f3..f325fb91359 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/VerifyAuthChallengeResponse/VerifyAuthChallengeResponse.map.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/VerifyAuthChallengeResponse/VerifyAuthChallengeResponse.map.json
@@ -8,7 +8,7 @@
         "value": "askUser",
         "private": true,
         "question": {
-          "name" : "RECAPTCHASECRET",
+          "name": "RECAPTCHASECRET",
           "type": "input",
           "message": "Enter the Google reCaptcha secret key:"
         }
@@ -19,4 +19,4 @@
     "name": "Custom Auth Challenge Scaffolding (Verification)",
     "description": "1 of 3 triggers needed to set-up the basic scaffolding for a custom authentication flow.  Please note that this scaffolding should be built out using your desired functionality before being used in production."
   }
-}
\ No newline at end of file
+}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/VerifyAuthChallengeResponse/function-template-dir/event.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/VerifyAuthChallengeResponse/function-template-dir/event.json
index e7cf98603e0..fd2722e8599 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/VerifyAuthChallengeResponse/function-template-dir/event.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/VerifyAuthChallengeResponse/function-template-dir/event.json
@@ -1,5 +1,5 @@
 {
-    "key1": "value1",
-    "key2": "value2",
-    "key3": "value3"
-}
\ No newline at end of file
+  "key1": "value1",
+  "key2": "value2",
+  "key3": "value3"
+}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/cognito.map.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/cognito.map.json
index a68c3ae66ad..3f9c2d76a28 100644
--- a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/cognito.map.json
+++ b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/cognito.map.json
@@ -27,4 +27,4 @@
     "name": "Pre Token Generation"
   },
   "URL": "https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html"
-}
\ No newline at end of file
+}
diff --git a/packages/amplify-category-auth/resources/adminAuth/admin-auth-app.js b/packages/amplify-category-auth/resources/adminAuth/admin-auth-app.js
index 2cdeb3f345e..9c3d1ad14d3 100644
--- a/packages/amplify-category-auth/resources/adminAuth/admin-auth-app.js
+++ b/packages/amplify-category-auth/resources/adminAuth/admin-auth-app.js
@@ -44,7 +44,7 @@ app.use((req, res, next) => {
 // Only perform tasks if the user is in a specific group
 const allowedGroup = process.env.GROUP;
 
-const checkGroup = function(req, res, next) {
+const checkGroup = function (req, res, next) {
   if (req.path == '/signUserOut') {
     return next();
   }
@@ -264,10 +264,7 @@ app.post('/signUserOut', async (req, res, next) => {
 app.use((err, req, res, next) => {
   console.error(err.message);
   if (!err.statusCode) err.statusCode = 500; // If err has no specified error code, set error code to 'Internal Server Error (500)'
-  res
-    .status(err.statusCode)
-    .json({ message: err.message })
-    .end();
+  res.status(err.statusCode).json({ message: err.message }).end();
 });
 
 app.listen(3000, () => {
diff --git a/packages/amplify-category-auth/resources/auth-custom-resource/hostedUILambda.js b/packages/amplify-category-auth/resources/auth-custom-resource/hostedUILambda.js
new file mode 100644
index 00000000000..337f06cc17e
--- /dev/null
+++ b/packages/amplify-category-auth/resources/auth-custom-resource/hostedUILambda.js
@@ -0,0 +1,81 @@
+const response = require('cfn-response');
+const aws = require('aws-sdk');
+const identity = new aws.CognitoIdentityServiceProvider();
+exports.handler = (event, context, callback) => {
+  const userPoolId = event.ResourceProperties.userPoolId;
+  const inputDomainName = event.ResourceProperties.hostedUIDomainName;
+  let deleteUserPoolDomain = domainName => {
+    let params = { Domain: domainName, UserPoolId: userPoolId };
+    return identity.deleteUserPoolDomain(params).promise();
+  };
+  if (event.RequestType == 'Delete') {
+    deleteUserPoolDomain(inputDomainName)
+      .then(() => {
+        response.send(event, context, response.SUCCESS, {});
+      })
+      .catch(err => {
+        console.log(err);
+        response.send(event, context, response.FAILED, { err });
+      });
+  }
+  if (event.RequestType == 'Update' || event.RequestType == 'Create') {
+    let checkDomainAvailability = domainName => {
+      let params = { Domain: domainName };
+      return identity
+        .describeUserPoolDomain(params)
+        .promise()
+        .then(res => {
+          if (res.DomainDescription && res.DomainDescription.UserPool) {
+            return false;
+          }
+          return true;
+        })
+        .catch(err => {
+          return false;
+        });
+    };
+    let createUserPoolDomain = domainName => {
+      let params = { Domain: domainName, UserPoolId: userPoolId };
+      return identity.createUserPoolDomain(params).promise();
+    };
+    identity
+      .describeUserPool({ UserPoolId: userPoolId })
+      .promise()
+      .then(result => {
+        if (inputDomainName) {
+          if (result.UserPool.Domain === inputDomainName) {
+            return;
+          } else {
+            if (!result.UserPool.Domain) {
+              return checkDomainAvailability(inputDomainName).then(isDomainAvailable => {
+                if (isDomainAvailable) {
+                  return createUserPoolDomain(inputDomainName);
+                } else {
+                  throw new Error('Domain not available');
+                }
+              });
+            } else {
+              return checkDomainAvailability(inputDomainName).then(isDomainAvailable => {
+                if (isDomainAvailable) {
+                  return deleteUserPoolDomain(result.UserPool.Domain).then(() => createUserPoolDomain(inputDomainName));
+                } else {
+                  throw new Error('Domain not available');
+                }
+              });
+            }
+          }
+        } else {
+          if (result.UserPool.Domain) {
+            return deleteUserPoolDomain(result.UserPool.Domain);
+          }
+        }
+      })
+      .then(() => {
+        response.send(event, context, response.SUCCESS, {});
+      })
+      .catch(err => {
+        console.log(err);
+        response.send(event, context, response.FAILED, { err });
+      });
+  }
+};
diff --git a/packages/amplify-category-auth/resources/auth-custom-resource/hostedUIProviderLambda.js b/packages/amplify-category-auth/resources/auth-custom-resource/hostedUIProviderLambda.js
new file mode 100644
index 00000000000..7004326fc36
--- /dev/null
+++ b/packages/amplify-category-auth/resources/auth-custom-resource/hostedUIProviderLambda.js
@@ -0,0 +1,100 @@
+const response = require('cfn-response');
+const aws = require('aws-sdk');
+const identity = new aws.CognitoIdentityServiceProvider();
+exports.handler = (event, context, callback) => {
+  try {
+    const userPoolId = event.ResourceProperties.userPoolId;
+    let hostedUIProviderMeta = JSON.parse(event.ResourceProperties.hostedUIProviderMeta);
+    let hostedUIProviderCreds = JSON.parse(event.ResourceProperties.hostedUIProviderCreds);
+    if (hostedUIProviderCreds.length === 0) {
+      response.send(event, context, response.SUCCESS, {});
+    }
+    if (event.RequestType == 'Delete') {
+      response.send(event, context, response.SUCCESS, {});
+    }
+    if (event.RequestType == 'Update' || event.RequestType == 'Create') {
+      let getRequestParams = providerName => {
+        let providerMetaIndex = hostedUIProviderMeta.findIndex(provider => provider.ProviderName === providerName);
+        let providerMeta = hostedUIProviderMeta[providerMetaIndex];
+        let providerCredsIndex = hostedUIProviderCreds.findIndex(provider => provider.ProviderName === providerName);
+        let providerCreds = hostedUIProviderCreds[providerCredsIndex];
+        let requestParams = {
+          ProviderName: providerMeta.ProviderName,
+          UserPoolId: userPoolId,
+          AttributeMapping: providerMeta.AttributeMapping,
+        };
+        if (providerMeta.ProviderName === 'SignInWithApple') {
+          if (providerCreds.client_id && providerCreds.team_id && providerCreds.key_id && providerCreds.private_key) {
+            requestParams.ProviderDetails = {
+              client_id: providerCreds.client_id,
+              team_id: providerCreds.team_id,
+              key_id: providerCreds.key_id,
+              private_key: providerCreds.private_key,
+              authorize_scopes: providerMeta.authorize_scopes,
+            };
+          } else {
+            requestParams = null;
+          }
+        } else {
+          requestParams.ProviderDetails = {
+            client_id: providerCreds.client_id,
+            client_secret: providerCreds.client_secret,
+            authorize_scopes: providerMeta.authorize_scopes,
+          };
+        }
+        return requestParams;
+      };
+      let createIdentityProvider = providerName => {
+        let requestParams = getRequestParams(providerName);
+        if (!requestParams) {
+          return Promise.resolve();
+        }
+        requestParams.ProviderType = requestParams.ProviderName;
+        return identity.createIdentityProvider(requestParams).promise();
+      };
+      let updateIdentityProvider = providerName => {
+        let requestParams = getRequestParams(providerName);
+        if (!requestParams) {
+          return Promise.resolve();
+        }
+        return identity.updateIdentityProvider(requestParams).promise();
+      };
+      let deleteIdentityProvider = providerName => {
+        let params = { ProviderName: providerName, UserPoolId: userPoolId };
+        return identity.deleteIdentityProvider(params).promise();
+      };
+      let providerPromises = [];
+      identity
+        .listIdentityProviders({ UserPoolId: userPoolId, MaxResults: 60 })
+        .promise()
+        .then(result => {
+          console.log(result);
+          let providerList = result.Providers.map(provider => provider.ProviderName);
+          let providerListInParameters = hostedUIProviderMeta.map(provider => provider.ProviderName);
+          hostedUIProviderMeta.forEach(providerMetadata => {
+            if (providerList.indexOf(providerMetadata.ProviderName) > 1) {
+              providerPromises.push(updateIdentityProvider(providerMetadata.ProviderName));
+            } else {
+              providerPromises.push(createIdentityProvider(providerMetadata.ProviderName));
+            }
+          });
+          providerList.forEach(provider => {
+            if (providerListInParameters.indexOf(provider) < 0) {
+              providerPromises.push(deleteIdentityProvider(provider));
+            }
+          });
+          return Promise.all(providerPromises);
+        })
+        .then(() => {
+          response.send(event, context, response.SUCCESS, {});
+        })
+        .catch(err => {
+          console.log(err.stack);
+          response.send(event, context, response.FAILED, { err });
+        });
+    }
+  } catch (err) {
+    console.log(err.stack);
+    response.send(event, context, response.FAILED, { err });
+  }
+};
diff --git a/packages/amplify-category-auth/resources/auth-custom-resource/mfaLambda.js b/packages/amplify-category-auth/resources/auth-custom-resource/mfaLambda.js
new file mode 100644
index 00000000000..28779747831
--- /dev/null
+++ b/packages/amplify-category-auth/resources/auth-custom-resource/mfaLambda.js
@@ -0,0 +1,37 @@
+const response = require('cfn-response');
+const aws = require('aws-sdk');
+const identity = new aws.CognitoIdentityServiceProvider();
+exports.handler = (event, context, callback) => {
+  if (event.RequestType == 'Delete') {
+    response.send(event, context, response.SUCCESS, {});
+  }
+  if (event.RequestType == 'Update' || event.RequestType == 'Create') {
+    let totpParams = {};
+    try {
+      totpParams = {
+        UserPoolId: event.ResourceProperties.userPoolId,
+        MfaConfiguration: event.ResourceProperties.mfaConfiguration,
+        SmsMfaConfiguration: {
+          SmsAuthenticationMessage: event.ResourceProperties.smsAuthenticationMessage,
+          SmsConfiguration: {
+            SnsCallerArn: event.ResourceProperties.smsConfigCaller,
+            ExternalId: event.ResourceProperties.smsConfigExternalId,
+          },
+        },
+        SoftwareTokenMfaConfiguration: { Enabled: event.ResourceProperties.totpEnabled.toLowerCase() === true ? true : false },
+      };
+      console.log(totpParams);
+    } catch (e) {
+      response.send(event, context, response.FAILED, { e });
+    }
+    identity
+      .setUserPoolMfaConfig(totpParams)
+      .promise()
+      .then(res => {
+        response.send(event, context, response.SUCCESS, { res });
+      })
+      .catch(err => {
+        response.send(event, context, response.FAILED, { err });
+      });
+  }
+};
diff --git a/packages/amplify-category-auth/resources/auth-custom-resource/oauthLambda.js b/packages/amplify-category-auth/resources/auth-custom-resource/oauthLambda.js
new file mode 100644
index 00000000000..267cc4a69a4
--- /dev/null
+++ b/packages/amplify-category-auth/resources/auth-custom-resource/oauthLambda.js
@@ -0,0 +1,45 @@
+const response = require('cfn-response');
+const aws = require('aws-sdk');
+const identity = new aws.CognitoIdentityServiceProvider();
+exports.handler = (event, context, callback) => {
+  try {
+    const userPoolId = event.ResourceProperties.userPoolId;
+    let webClientId = event.ResourceProperties.webClientId;
+    let nativeClientId = event.ResourceProperties.nativeClientId;
+    let hostedUIProviderMeta = JSON.parse(event.ResourceProperties.hostedUIProviderMeta);
+    let oAuthMetadata = JSON.parse(event.ResourceProperties.oAuthMetadata);
+    let providerList = hostedUIProviderMeta.map(provider => provider.ProviderName);
+    providerList.push('COGNITO');
+    if (event.RequestType == 'Delete') {
+      response.send(event, context, response.SUCCESS, {});
+    }
+    if (event.RequestType == 'Update' || event.RequestType == 'Create') {
+      let params = {
+        UserPoolId: userPoolId,
+        AllowedOAuthFlows: oAuthMetadata.AllowedOAuthFlows,
+        AllowedOAuthFlowsUserPoolClient: true,
+        AllowedOAuthScopes: oAuthMetadata.AllowedOAuthScopes,
+        CallbackURLs: oAuthMetadata.CallbackURLs,
+        LogoutURLs: oAuthMetadata.LogoutURLs,
+        SupportedIdentityProviders: providerList,
+      };
+      console.log(params);
+      let updateUserPoolClientPromises = [];
+      params.ClientId = webClientId;
+      updateUserPoolClientPromises.push(identity.updateUserPoolClient(params).promise());
+      params.ClientId = nativeClientId;
+      updateUserPoolClientPromises.push(identity.updateUserPoolClient(params).promise());
+      Promise.all(updateUserPoolClientPromises)
+        .then(() => {
+          response.send(event, context, response.SUCCESS, {});
+        })
+        .catch(err => {
+          console.log(err.stack);
+          response.send(event, context, response.FAILED, { err });
+        });
+    }
+  } catch (err) {
+    console.log(err.stack);
+    response.send(event, context, response.FAILED, { err });
+  }
+};
diff --git a/packages/amplify-category-auth/resources/auth-custom-resource/openIdLambda.js b/packages/amplify-category-auth/resources/auth-custom-resource/openIdLambda.js
new file mode 100644
index 00000000000..ca06777578d
--- /dev/null
+++ b/packages/amplify-category-auth/resources/auth-custom-resource/openIdLambda.js
@@ -0,0 +1,77 @@
+const response = require('cfn-response');
+const aws = require('aws-sdk');
+const iam = new aws.IAM();
+exports.handler = (event, context) => {
+  if (event.RequestType == 'Delete') {
+    response.send(event, context, response.SUCCESS, {});
+  }
+  if (event.RequestType == 'Update' || event.RequestType == 'Create') {
+    const params = {
+      ClientIDList: event.ResourceProperties.clientIdList.split(','),
+      ThumbprintList: ['0000000000000000000000000000000000000000'],
+      Url: event.ResourceProperties.url,
+    };
+    let exists = false;
+    let existingValue;
+    iam
+      .listOpenIDConnectProviders({})
+      .promise()
+      .then(data => {
+        if (data.OpenIDConnectProviderList && data.OpenIDConnectProviderList.length > 0) {
+          const vals = data.OpenIDConnectProviderList.map(x => x.Arn);
+          existingValue = vals.find(i => i.split('/')[1] === params.Url.split('//')[1]);
+          if (!existingValue) {
+            exists = true;
+          }
+        }
+        if (!existingValue) {
+          iam
+            .createOpenIDConnectProvider(params)
+            .promise()
+            .then(data => {
+              response.send(event, context, response.SUCCESS, {
+                providerArn: data.OpenIDConnectProviderArn,
+                providerIds: params.ClientIDList,
+              });
+            })
+            .catch(err => {
+              response.send(event, context, response.FAILED, { err });
+            });
+        } else {
+          const findParams = {
+            OpenIDConnectProviderArn: existingValue,
+          };
+          iam
+            .getOpenIDConnectProvider(findParams)
+            .promise()
+            .then(data => {
+              const audiences = data.ClientIDList;
+              const updateCalls = [];
+              params.ClientIDList.forEach(a => {
+                if (!audiences.includes(a)) {
+                  const updateParams = {
+                    ClientID: a,
+                    OpenIDConnectProviderArn: existingValue,
+                  };
+                  const prom = iam.addClientIDToOpenIDConnectProvider(updateParams).promise();
+                  updateCalls.push(prom);
+                }
+              });
+              Promise.all(updateCalls)
+                .then(function (values) {
+                  response.send(event, context, response.SUCCESS, { providerArn: existingValue, providerIds: params.ClientIDList });
+                })
+                .catch(err3 => {
+                  response.send(event, context, response.FAILED, { err3 });
+                });
+            })
+            .catch(err2 => {
+              response.send(event, context, response.FAILED, { err2 });
+            });
+        }
+      })
+      .catch(err1 => {
+        response.send(event, context, response.FAILED, { err1 });
+      });
+  }
+};
diff --git a/packages/amplify-category-auth/resources/auth-custom-resource/role-map-lambda-function.js b/packages/amplify-category-auth/resources/auth-custom-resource/role-map-lambda-function.js
new file mode 100644
index 00000000000..8c714633780
--- /dev/null
+++ b/packages/amplify-category-auth/resources/auth-custom-resource/role-map-lambda-function.js
@@ -0,0 +1,37 @@
+const response = require('cfn-response');
+const AWS = require('aws-sdk');
+exports.handler = (event, context) => {
+  if (event.RequestType == 'Delete') {
+    response.send(event, context, response.SUCCESS, { message: 'Request type delete' });
+  }
+  if (event.RequestType == 'Create' || event.RequestType == 'Update') {
+    let { identityPoolId, appClientID, appClientIDWeb, userPoolId, region } = event.ResourceProperties;
+    try {
+      const cognitoidentity = new AWS.CognitoIdentity();
+      let params = {
+        IdentityPoolId: identityPoolId,
+        Roles: {
+          authenticated: event.ResourceProperties.AuthRoleArn,
+          unauthenticated: event.ResourceProperties.UnauthRoleArn,
+        },
+        RoleMappings: {},
+      };
+      if (appClientIDWeb) {
+        params.RoleMappings[`cognito-idp.${region}.amazonaws.com/${userPoolId}:${appClientIDWeb}`] = {
+          Type: 'Token',
+          AmbiguousRoleResolution: 'AuthenticatedRole',
+        };
+      }
+      if (appClientID) {
+        params.RoleMappings[`cognito-idp.${region}.amazonaws.com/${userPoolId}:${appClientID}`] = {
+          Type: 'Token',
+          AmbiguousRoleResolution: 'AuthenticatedRole',
+        };
+      }
+      cognitoidentity.setIdentityPoolRoles(params).promise();
+      response.send(event, context, response.SUCCESS, { message: 'Successfully updated identity pool.' });
+    } catch (err) {
+      response.send(event, context, response.FAILED, { message: 'Error updating identity pool' });
+    }
+  }
+};
diff --git a/packages/amplify-category-auth/resources/auth-custom-resource/userpoolclientLambda.js b/packages/amplify-category-auth/resources/auth-custom-resource/userpoolclientLambda.js
new file mode 100644
index 00000000000..90c5464c021
--- /dev/null
+++ b/packages/amplify-category-auth/resources/auth-custom-resource/userpoolclientLambda.js
@@ -0,0 +1,23 @@
+const response = require('cfn-response');
+const aws = require('aws-sdk');
+const identity = new aws.CognitoIdentityServiceProvider();
+exports.handler = (event, context, callback) => {
+  if (event.RequestType == 'Delete') {
+    response.send(event, context, response.SUCCESS, {});
+  }
+  if (event.RequestType == 'Update' || event.RequestType == 'Create') {
+    const params = {
+      ClientId: event.ResourceProperties.clientId,
+      UserPoolId: event.ResourceProperties.userpoolId,
+    };
+    identity
+      .describeUserPoolClient(params)
+      .promise()
+      .then(res => {
+        response.send(event, context, response.SUCCESS, { appSecret: res.UserPoolClient.ClientSecret });
+      })
+      .catch(err => {
+        response.send(event, context, response.FAILED, { err });
+      });
+  }
+};
diff --git a/packages/amplify-category-auth/resources/overrides-resource/override.ts b/packages/amplify-category-auth/resources/overrides-resource/override.ts
new file mode 100644
index 00000000000..c02cee5ebd4
--- /dev/null
+++ b/packages/amplify-category-auth/resources/overrides-resource/override.ts
@@ -0,0 +1,6 @@
+/* Add Amplify Helper dependencies     */
+
+/* TODO: Need to change props to Root-Stack specific props when props are ready */
+export function overrideProps(props: any): void {
+  /* TODO: Add snippet of how to override in comments */
+}
diff --git a/packages/amplify-category-auth/resources/overrides-resource/package.json b/packages/amplify-category-auth/resources/overrides-resource/package.json
new file mode 100644
index 00000000000..916c8cc8afb
--- /dev/null
+++ b/packages/amplify-category-auth/resources/overrides-resource/package.json
@@ -0,0 +1,18 @@
+{
+    "name": "overrides-for-auth-resource",
+    "version": "1.0.0",
+    "description": "",
+    "scripts": {
+      "build": "tsc",
+      "watch": "tsc -w",
+      "test": "echo \"Error: no test specified\" && exit 1"
+    },
+    "dependencies": {
+      "@types/fs-extra": "^9.0.11",
+      "fs-extra": "^9.1.0"
+    },
+    "devDependencies": {
+      "typescript": "^4.2.4"
+    }
+  }
+  
\ No newline at end of file
diff --git a/packages/amplify-category-auth/resources/overrides-resource/tsconfig.json b/packages/amplify-category-auth/resources/overrides-resource/tsconfig.json
new file mode 100644
index 00000000000..a7644e812e6
--- /dev/null
+++ b/packages/amplify-category-auth/resources/overrides-resource/tsconfig.json
@@ -0,0 +1,11 @@
+{
+    "compilerOptions": {
+      "target": "es6",
+      "module": "commonjs",
+      "strict": false,
+      "esModuleInterop": true,
+      "forceConsistentCasingInFileNames": true,
+      "outDir": "build"
+    }
+  }
+  
\ No newline at end of file
diff --git a/packages/amplify-category-auth/resources/overrides-resource/tsconfig.resource.json b/packages/amplify-category-auth/resources/overrides-resource/tsconfig.resource.json
new file mode 100644
index 00000000000..6504da80283
--- /dev/null
+++ b/packages/amplify-category-auth/resources/overrides-resource/tsconfig.resource.json
@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "es6",
+    "module": "commonjs",
+    "strict": false,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "outDir": "./",
+    "rootDir": "../"
+  },
+  "include": ["../**/*"]
+}
diff --git a/packages/amplify-category-auth/resources/schemas/awsCognito/CognitoCLIInputs.schema.json b/packages/amplify-category-auth/resources/schemas/awsCognito/CognitoCLIInputs.schema.json
new file mode 100644
index 00000000000..549764f7c3c
--- /dev/null
+++ b/packages/amplify-category-auth/resources/schemas/awsCognito/CognitoCLIInputs.schema.json
@@ -0,0 +1,290 @@
+{
+  "type": "object",
+  "properties": {
+    "version": {
+      "type": "string"
+    },
+    "cognitoConfig": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/ServiceQuestionsBaseResult"
+        },
+        {
+          "$ref": "#/definitions/Pick<OAuthResult,\"hostedUI\"|\"hostedUIDomainName\"|\"hostedUIProviderMeta\"|\"oAuthMetadata\">"
+        },
+        {
+          "$ref": "#/definitions/Pick<SocialProviderResult,\"authProvidersUserPool\">"
+        },
+        {
+          "$ref": "#/definitions/IdentityPoolResult"
+        },
+        {
+          "$ref": "#/definitions/PasswordPolicyResult"
+        },
+        {
+          "$ref": "#/definitions/PasswordRecoveryResult"
+        },
+        {
+          "$ref": "#/definitions/MfaResult"
+        },
+        {
+          "$ref": "#/definitions/AdminQueriesResult"
+        },
+        {
+          "$ref": "#/definitions/Triggers"
+        }
+      ]
+    }
+  },
+  "required": ["cognitoConfig"],
+  "definitions": {
+    "ServiceQuestionsBaseResult": {
+      "type": "object",
+      "properties": {
+        "serviceName": {
+          "type": "string",
+          "enum": ["Cognito"]
+        },
+        "resourceName": {
+          "type": "string"
+        },
+        "useDefault": {
+          "enum": ["default", "defaultSocial", "manual"],
+          "type": "string"
+        },
+        "updateFlow": {
+          "enum": ["callbacks", "default", "defaultSocial", "manual", "providers", "updateAdminQueries", "updateUserPoolGroups"],
+          "type": "string"
+        },
+        "requiredAttributes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "authSelections": {
+          "enum": ["identityPoolAndUserPool", "identityPoolOnly", "userPoolOnly"],
+          "type": "string"
+        },
+        "userPoolName": {
+          "type": "string"
+        },
+        "usernameAttributes": {
+          "type": "array",
+          "items": {
+            "enum": ["email", "phone_number"],
+            "type": "string"
+          }
+        },
+        "aliasAttributes": {
+          "type": "array",
+          "items": {
+            "enum": ["email", "phone_number", "preferred_username"],
+            "type": "string"
+          }
+        },
+        "userPoolGroups": {
+          "type": "boolean"
+        },
+        "userPoolGroupList": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "userpoolClientRefreshTokenValidity": {
+          "type": "number"
+        },
+        "userpoolClientReadAttributes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "userpoolClientWriteAttributes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "userpoolClientSetAttributes": {
+          "type": "boolean"
+        },
+        "usernameCaseSensitive": {
+          "type": "boolean"
+        },
+        "verificationBucketName": {
+          "type": "string"
+        },
+        "resourceNameTruncated": {
+          "type": "string"
+        },
+        "sharedId": {
+          "type": "string"
+        },
+        "userpoolClientGenerateSecret": {
+          "type": "boolean"
+        },
+        "userpoolClientLambdaRole": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "authSelections",
+        "requiredAttributes",
+        "resourceName",
+        "serviceName",
+        "useDefault",
+        "userpoolClientGenerateSecret",
+        "userpoolClientLambdaRole",
+        "userpoolClientReadAttributes",
+        "userpoolClientWriteAttributes"
+      ]
+    },
+    "Pick<OAuthResult,\"hostedUI\"|\"hostedUIDomainName\"|\"hostedUIProviderMeta\"|\"oAuthMetadata\">": {
+      "type": "object",
+      "properties": {
+        "hostedUI": {
+          "type": "boolean"
+        },
+        "hostedUIDomainName": {
+          "type": "string"
+        },
+        "hostedUIProviderMeta": {},
+        "oAuthMetadata": {}
+      }
+    },
+    "Pick<SocialProviderResult,\"authProvidersUserPool\">": {
+      "type": "object",
+      "properties": {
+        "authProvidersUserPool": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "IdentityPoolResult": {
+      "type": "object",
+      "properties": {
+        "thirdPartyAuth": {
+          "type": "boolean"
+        },
+        "identityPoolName": {
+          "type": "string"
+        },
+        "allowUnauthenticatedIdentities": {
+          "type": "boolean"
+        },
+        "authProviders": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "googleClientId": {
+          "type": "string"
+        },
+        "googleIos": {
+          "type": "string"
+        },
+        "googleAndroid": {
+          "type": "string"
+        },
+        "facebookAppId": {
+          "type": "string"
+        },
+        "amazonAppId": {
+          "type": "string"
+        },
+        "appleAppId": {
+          "type": "string"
+        },
+        "selectedParties": {
+          "type": "string"
+        },
+        "audiences": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "PasswordPolicyResult": {
+      "type": "object",
+      "properties": {
+        "passwordPolicyCharacters": {
+          "type": "array",
+          "items": {
+            "enum": ["Requires Lowercase", "Requires Numbers", "Requires Symbols", "Requires Uppercase"],
+            "type": "string"
+          }
+        },
+        "passwordPolicyMinLength": {
+          "type": "number"
+        }
+      }
+    },
+    "PasswordRecoveryResult": {
+      "type": "object",
+      "properties": {
+        "emailVerificationMessage": {
+          "type": "string"
+        },
+        "emailVerificationSubject": {
+          "type": "string"
+        },
+        "smsVerificationMessage": {
+          "type": "string"
+        },
+        "autoVerifiedAttributes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "required": ["autoVerifiedAttributes"]
+    },
+    "MfaResult": {
+      "type": "object",
+      "properties": {
+        "mfaConfiguration": {
+          "enum": ["OFF", "ON", "OPTIONAL"],
+          "type": "string"
+        },
+        "mfaTypes": {
+          "type": "array",
+          "items": {
+            "enum": ["SMS Text Message", "TOTP"],
+            "type": "string"
+          }
+        },
+        "smsAuthenticationMessage": {
+          "type": "string"
+        }
+      },
+      "required": ["mfaConfiguration"]
+    },
+    "AdminQueriesResult": {
+      "type": "object",
+      "properties": {
+        "adminQueries": {
+          "type": "boolean"
+        },
+        "adminQueryGroup": {
+          "type": "string"
+        }
+      }
+    },
+    "Triggers": {
+      "type": "object",
+      "properties": {
+        "triggers": {}
+      }
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}
diff --git a/packages/amplify-category-auth/scripts/generateAuthSchemas.ts b/packages/amplify-category-auth/scripts/generateAuthSchemas.ts
new file mode 100644
index 00000000000..80a81117a43
--- /dev/null
+++ b/packages/amplify-category-auth/scripts/generateAuthSchemas.ts
@@ -0,0 +1,14 @@
+import * as SchemaGenerator from 'amplify-cli-core';
+
+type TypeDef = SchemaGenerator.TypeDef;
+
+const CognitoAuthTypeDef: TypeDef = {
+  typeName: 'CognitoCLIInputs',
+  service: 'awsCognito',
+};
+
+// Defines the type names and the paths to the TS files that define them
+const authCategoryTypeDefs: TypeDef[] = [CognitoAuthTypeDef];
+
+const schemaGenerator = new SchemaGenerator.CLIInputSchemaGenerator(authCategoryTypeDefs);
+schemaGenerator.generateJSONSchemas(); //convert CLI input data into json schemas.
diff --git a/packages/amplify-category-auth/src/__tests__/commands/enable.test.js b/packages/amplify-category-auth/src/__tests__/commands/enable.test.ts
similarity index 95%
rename from packages/amplify-category-auth/src/__tests__/commands/enable.test.js
rename to packages/amplify-category-auth/src/__tests__/commands/enable.test.ts
index 290eebdfda6..b0f1e9165c3 100644
--- a/packages/amplify-category-auth/src/__tests__/commands/enable.test.js
+++ b/packages/amplify-category-auth/src/__tests__/commands/enable.test.ts
@@ -2,8 +2,6 @@ const fs = require('fs');
 const add = require('../../commands/auth/enable');
 const { messages } = require('../../provider-utils/awscloudformation/assets/string-maps');
 const providerController = require('../../provider-utils/awscloudformation');
-const { FeatureFlags } = require('amplify-cli-core');
-FeatureFlags.getBoolean = () => false;
 
 jest.mock('../../provider-utils/awscloudformation', () => ({
   addResource: jest.fn(),
diff --git a/packages/amplify-category-auth/src/__tests__/commands/import.headless.test.ts b/packages/amplify-category-auth/src/__tests__/commands/import.headless.test.ts
index 1319abc8762..7e8c49367ab 100644
--- a/packages/amplify-category-auth/src/__tests__/commands/import.headless.test.ts
+++ b/packages/amplify-category-auth/src/__tests__/commands/import.headless.test.ts
@@ -1,16 +1,9 @@
-import { executeAmplifyHeadlessCommand } from '../../../src';
+import { executeAmplifyHeadlessCommand } from '../../..';
 import { ImportAuthRequest } from 'amplify-headless-interface';
 import { messages } from '../../provider-utils/awscloudformation/assets/string-maps';
-import { stateManager, FeatureFlags, JSONUtilities } from 'amplify-cli-core';
-import { printer } from 'amplify-prompts';
-
-jest.mock('amplify-prompts', () => ({
-  printer: {
-    info: jest.fn(),
-  },
-}));
 
 jest.mock('amplify-cli-core', () => ({
+  ...(jest.requireActual('amplify-cli-core') as {}),
   stateManager: {
     setResourceParametersJson: jest.fn(),
     getMeta: jest.fn().mockReturnValue({
@@ -19,14 +12,10 @@ jest.mock('amplify-cli-core', () => ({
       },
     }),
   },
-  FeatureFlags: {
-    getBoolean: () => false,
-  },
-  JSONUtilities: {
-    parse: JSON.parse,
-  },
 }));
 
+jest.mock('../../provider-utils/awscloudformation/auth-inputs-manager/auth-input-state');
+
 describe('import auth headless', () => {
   let mockContext: any;
   const USER_POOL_ID = 'user-pool-123';
diff --git a/packages/amplify-category-auth/src/__tests__/commands/override.test.ts b/packages/amplify-category-auth/src/__tests__/commands/override.test.ts
new file mode 100644
index 00000000000..d107b07b021
--- /dev/null
+++ b/packages/amplify-category-auth/src/__tests__/commands/override.test.ts
@@ -0,0 +1,65 @@
+import { run } from '../../commands/auth/override';
+import { $TSContext, generateOverrideSkeleton } from 'amplify-cli-core';
+import { AuthInputState } from '../../provider-utils/awscloudformation/auth-inputs-manager/auth-input-state';
+import { checkAuthResourceMigration } from '../../provider-utils/awscloudformation/utils/check-for-auth-migration';
+
+jest.mock('../../provider-utils/awscloudformation/auth-inputs-manager/auth-input-state');
+
+jest.mock('fs-extra');
+
+jest.mock('amplify-prompts', () => ({
+  printer: {
+    warn: jest.fn(),
+    debug: jest.fn(),
+    error: jest.fn(),
+  },
+  prompter: {
+    confirmContinue: jest.fn().mockReturnValue(true),
+    pick: jest.fn().mockReturnValue('mockResource'),
+  },
+}));
+
+jest.mock('amplify-cli-core', () => ({
+  ...(jest.requireActual('amplify-cli-core') as {}),
+  stateManager: {
+    getMeta: jest
+      .fn()
+      .mockReturnValueOnce({
+        auth: {
+          mockResource1: {},
+        },
+      })
+      .mockReturnValueOnce({
+        auth: {},
+      }),
+  },
+  pathManager: {
+    getBackendDirPath: jest.fn().mockReturnValue('mockDirPath'),
+  },
+  generateOverrideSkeleton: jest.fn(),
+}));
+
+jest.mock('../../provider-utils/awscloudformation/utils/migrate-override-resource', () => ({
+  migrateResourceToSupportOverride: jest.fn(),
+}));
+
+jest.mock('../../provider-utils/awscloudformation/utils/generate-auth-stack-template', () => ({
+  generateAuthStackTemplate: jest.fn(),
+}));
+
+jest.mock('../../provider-utils/awscloudformation/utils/check-for-auth-migration', () => ({
+  checkAuthResourceMigration: jest.fn(),
+}));
+
+test('check migration gets called when there is a resource', async () => {
+  await run({} as unknown as $TSContext);
+  expect(checkAuthResourceMigration).toBeCalled();
+  expect(generateOverrideSkeleton).toBeCalled();
+});
+
+test('check migration doesnt gets called when there is no resource', async () => {
+  jest.clearAllMocks();
+  await run({} as unknown as $TSContext);
+  expect(checkAuthResourceMigration).not.toBeCalled();
+  expect(generateOverrideSkeleton).not.toBeCalled();
+});
diff --git a/packages/amplify-category-auth/src/__tests__/commands/remove.test.js b/packages/amplify-category-auth/src/__tests__/commands/remove.test.js
deleted file mode 100644
index b757aa2195b..00000000000
--- a/packages/amplify-category-auth/src/__tests__/commands/remove.test.js
+++ /dev/null
@@ -1,77 +0,0 @@
-const { printer } = require('amplify-prompts');
-const remove = require('../../commands/auth/remove');
-const { messages } = require('../../provider-utils/awscloudformation/assets/string-maps');
-
-jest.mock('amplify-prompts');
-printer.info = jest.fn();
-
-describe('auth remove: ', () => {
-  const mockExecuteProviderUtils = jest.fn();
-  const mockGetProjectDetails = jest.fn();
-  const warningString = messages.dependenciesExists;
-  const mockRemoveResource = jest.fn().mockReturnValue(Promise.resolve({}));
-  const mockProjectPath = '/User/someone/Documents/Project/amplify-test';
-  const mockContext = {
-    amplify: {
-      executeProviderUtils: mockExecuteProviderUtils,
-      getProjectDetails: mockGetProjectDetails,
-      removeResource: mockRemoveResource,
-    },
-    parameters: {
-      first: 'mockFirst',
-    },
-  };
-  const dependencies = ['analytics', 'api', 'function', 'storage'];
-
-  it('remove run method should exist', () => {
-    expect(remove.run).toBeDefined();
-  });
-
-  describe('case: resources may rely on auth', () => {
-    dependencies.forEach(d => {
-      beforeEach(() => {
-        const amplifyMeta = {};
-        amplifyMeta[d] = {};
-        amplifyMeta[d].foo = 'bar';
-        mockGetProjectDetails.mockReturnValue({
-          projectConfig: {
-            projectPath: mockProjectPath,
-          },
-          amplifyMeta,
-        });
-      });
-
-      it(`remove method should detect existing ${d} metadata and display warning`, async () => {
-        await remove.run(mockContext);
-        expect(printer.info).toBeCalledWith(warningString);
-      });
-
-      it(`remove method should still be called even when warning displayed for existing ${d} resource`, async () => {
-        await remove.run(mockContext);
-        expect(mockContext.amplify.removeResource).toBeCalled();
-      });
-    });
-  });
-
-  describe('case: auth and other resources not yet enabled', () => {
-    beforeEach(() => {
-      jest.clearAllMocks();
-      mockGetProjectDetails.mockReturnValue({
-        projectConfig: {
-          projectPath: mockProjectPath,
-        },
-        amplifyMeta: {},
-      });
-    });
-
-    it('service selection prompt should be called', async () => {
-      await remove.run(mockContext);
-      expect(mockContext.amplify.removeResource).toBeCalled();
-    });
-
-    it('should not display a warning for existing resources', async () => {
-      await remove.run(mockContext);
-      expect(printer.info).not.toBeCalledWith(warningString);
-    });
-  });
-});
diff --git a/packages/amplify-category-auth/src/__tests__/commands/remove.test.ts b/packages/amplify-category-auth/src/__tests__/commands/remove.test.ts
new file mode 100644
index 00000000000..63ee0520cae
--- /dev/null
+++ b/packages/amplify-category-auth/src/__tests__/commands/remove.test.ts
@@ -0,0 +1,130 @@
+import * as remove from '../../commands/auth/remove';
+import { messages } from '../../provider-utils/awscloudformation/assets/string-maps';
+import { $TSContext } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
+
+jest.mock('amplify-prompts', () => ({
+  printer: {
+    info: jest.fn(),
+  },
+}));
+
+const saveCLIInputPayload_mock = jest.fn();
+
+jest.mock('fs-extra');
+
+jest.mock('../../provider-utils/awscloudformation/auth-inputs-manager/auth-input-state', () => {
+  return {
+    AuthInputState: jest.fn().mockImplementation(() => {
+      return {
+        isCLIInputsValid: jest.fn(),
+        getCLIInputPayload: jest.fn().mockImplementation(() => ({
+          cognitoConfig: {
+            userPoolGroupList: ['admin'],
+          },
+        })),
+        saveCLIInputPayload: saveCLIInputPayload_mock,
+      };
+    }),
+  };
+});
+
+jest.mock('amplify-cli-core', () => ({
+  AmplifySupportedService: {
+    AUTH: 'Cognito',
+    COGNITOUSERPOOLGROUPS: 'Cognito-UserPool-Groups',
+  },
+  stateManager: {
+    getMeta: jest
+      .fn()
+      .mockReturnValueOnce({
+        analytics: {
+          mockResource1: {},
+        },
+        api: {
+          mockResource1: {},
+        },
+        function: {
+          mockResource1: {},
+        },
+        storage: {
+          mockResource1: {},
+        },
+        auth: {
+          mockResource1: {
+            service: 'Cognito',
+          },
+        },
+      })
+      .mockReturnValueOnce({
+        auth: {
+          mockResource1: {
+            service: 'Cognito',
+          },
+          mockResource2: {
+            service: 'Cognito-UserPool-Groups',
+          },
+        },
+      })
+      .mockReturnValueOnce({
+        analytics: {
+          mockResource1: {},
+        },
+        api: {
+          mockResource1: {},
+        },
+        function: {
+          mockResource1: {},
+        },
+        storage: {
+          mockResource1: {},
+        },
+        auth: {
+          mockResource1: {
+            service: 'Cognito',
+          },
+        },
+      }),
+  },
+}));
+
+const removeResource_mock = jest
+  .fn()
+  .mockResolvedValue({
+    service: 'Cognito',
+  })
+  .mockResolvedValueOnce({
+    service: 'Cognito',
+  })
+  .mockResolvedValueOnce({
+    service: 'Cognito-UserPool-Groups',
+  });
+
+const warningString = messages.dependenciesExists;
+const mockContext = {
+  amplify: {
+    removeResource: removeResource_mock,
+  },
+  parameters: {
+    first: 'mockFirst',
+  },
+};
+const context_stub_typed = mockContext as unknown as $TSContext;
+
+test(`remove method should detect existing categories metadata and display warning with no userPoolGroup`, async () => {
+  await remove.run(context_stub_typed);
+  expect(printer.info).toBeCalledWith(warningString);
+  expect(context_stub_typed.amplify.removeResource).toBeCalled();
+});
+
+test(`remove method should  not  display warning when there is no dependency with no userPoolGroup`, async () => {
+  jest.clearAllMocks();
+  await remove.run(context_stub_typed);
+  expect(printer.info).not.toBeCalledWith(warningString);
+  expect(context_stub_typed.amplify.removeResource).toBeCalled();
+});
+
+test(`remove method should still be called even when warning displayed for existing category resource and remmoves userPool group`, async () => {
+  await remove.run(context_stub_typed);
+  expect(saveCLIInputPayload_mock).toBeCalledWith({ cognitoConfig: { userPoolGroupList: [] } });
+});
diff --git a/packages/amplify-category-auth/src/__tests__/commands/update.test.js b/packages/amplify-category-auth/src/__tests__/commands/update.test.ts
similarity index 52%
rename from packages/amplify-category-auth/src/__tests__/commands/update.test.js
rename to packages/amplify-category-auth/src/__tests__/commands/update.test.ts
index c0dc0aa5d8e..1e4a6d2f86d 100644
--- a/packages/amplify-category-auth/src/__tests__/commands/update.test.js
+++ b/packages/amplify-category-auth/src/__tests__/commands/update.test.ts
@@ -1,14 +1,61 @@
-const fs = require('fs');
-const update = require('../../commands/auth/update');
-const { messages } = require('../../provider-utils/awscloudformation/assets/string-maps');
-const { FeatureFlags } = require('amplify-cli-core');
-FeatureFlags.getBoolean = () => false;
+import * as fs from 'fs-extra';
+import { $TSContext } from 'amplify-cli-core';
+import * as update from '../../commands/auth/update';
+import { messages } from '../../provider-utils/awscloudformation/assets/string-maps';
+import { printer } from 'amplify-prompts';
 
-jest.mock('fs', () => ({
+jest.mock('../../provider-utils/awscloudformation/auth-inputs-manager/auth-input-state');
+jest.mock('fs-extra', () => ({
   readFileSync: () => '{ "Cognito": { "provider": "aws"}}',
   existsSync: () => true,
 }));
 
+jest.mock('amplify-prompts');
+
+jest.mock('amplify-cli-core', () => ({
+  ...(jest.requireActual('amplify-cli-core') as {}),
+  AmplifySupportedService: {
+    COGNITO: 'Cognito',
+    COGNITOUSERPOOLGROUPS: 'Cognito-UserPool-Groups',
+  },
+  stateManager: {
+    getMeta: jest
+      .fn()
+      .mockReturnValue({})
+      .mockReturnValueOnce({
+        analytics: {
+          mockResource1: {},
+        },
+        api: {
+          mockResource1: {},
+        },
+        function: {
+          mockResource1: {},
+        },
+        storage: {
+          mockResource1: {},
+        },
+      })
+      .mockReturnValueOnce({
+        analytics: {
+          mockResource1: {},
+        },
+        api: {
+          mockResource1: {},
+        },
+        function: {
+          mockResource1: {},
+        },
+        storage: {
+          mockResource1: {},
+        },
+        auth: {
+          mockResource1: {},
+        },
+      }),
+  },
+}));
+
 describe('auth update: ', () => {
   const mockExecuteProviderUtils = jest.fn();
   const mockGetProjectDetails = jest.fn();
@@ -22,7 +69,7 @@ describe('auth update: ', () => {
       getProjectDetails: mockGetProjectDetails,
       serviceSelectionPrompt: mockSelectionPrompt,
       getPluginInstance: jest.fn().mockReturnValue(mockPluginInstance),
-      readJsonFile: jest.fn(path => JSON.parse(fs.readFileSync(path))),
+      readJsonFile: jest.fn(path => JSON.parse(fs.readFileSync(path, 'utf-8'))),
       pathManager: {
         getBackendDirPath: jest.fn(),
       },
@@ -31,15 +78,10 @@ describe('auth update: ', () => {
         return { allResources: [{ service: 'Cognito', serviceType: 'managed' }] };
       }, //eslint-disable-line
     },
-    print: {
-      warning: jest.fn(),
-      info: jest.fn(),
-      error: jest.fn(),
-    },
     usageData: {
       emitError: jest.fn(),
     },
-  };
+  } as unknown as $TSContext;
   const dependencies = ['analytics', 'api', 'function', 'storage'];
 
   it('update run method should exist', async () => {
@@ -52,55 +94,27 @@ describe('auth update: ', () => {
         projectConfig: {
           projectPath: mockProjectPath,
         },
-        amplifyMeta: {
-          auth: {},
-        },
       });
     });
     it('update run method should detect absence of auth resource and print a message', async () => {
       await update.run(mockContext);
-      expect(mockContext.print.warning).toBeCalledWith('Auth has not yet been added to this project.');
+      expect(printer.warn).toBeCalledWith('Project does not contain auth resources. Add auth using `amplify add auth`.');
     });
   });
 
   describe('case: resources may rely on auth', () => {
-    dependencies.forEach(d => {
-      beforeEach(() => {
-        const amplifyMeta = { auth: { foo: { bar: 'bar', Cognito: { provider: 'provider' } } } };
-        amplifyMeta[d] = {};
-        amplifyMeta[d].foo = 'bar';
-        mockGetProjectDetails.mockReturnValue({
-          projectConfig: {
-            projectPath: mockProjectPath,
-          },
-          amplifyMeta,
-        });
-      });
-      it(`update run method should detect presence of ${d} resource and print a message`, async () => {
-        await update.run(mockContext);
-        expect(mockContext.print.info).toBeCalledWith(messages.dependenciesExists);
-      });
-      it(`serviceSelectionPrompt should still be called even when warning displayed for existing ${d} resource`, async () => {
-        await update.run(mockContext);
-        expect(mockContext.amplify.serviceSelectionPrompt).toBeCalled();
-      });
-    });
-  });
-
-  describe('case: auth resource exists', () => {
     beforeEach(() => {
       mockGetProjectDetails.mockReturnValue({
         projectConfig: {
           projectPath: mockProjectPath,
         },
-        amplifyMeta: {
-          auth: {
-            foo: 'bar',
-          },
-        },
       });
     });
-    it('update run method should detect presence of storage resource and print a message', async () => {
+    it(`update run method should detect presence of dependent resource and print a message`, async () => {
+      await update.run(mockContext);
+      expect(printer.info).toBeCalledWith(messages.dependenciesExists);
+    });
+    it(`serviceSelectionPrompt should still be called even when warning displayed for existing resource`, async () => {
       await update.run(mockContext);
       expect(mockContext.amplify.serviceSelectionPrompt).toBeCalled();
     });
diff --git a/packages/amplify-category-auth/src/__tests__/mocks/cli-inputs.json b/packages/amplify-category-auth/src/__tests__/mocks/cli-inputs.json
new file mode 100644
index 00000000000..7eb63b6e56a
--- /dev/null
+++ b/packages/amplify-category-auth/src/__tests__/mocks/cli-inputs.json
@@ -0,0 +1,77 @@
+{
+  "identityPoolName": "extauth387063394_identitypool_87063394",
+  "allowUnauthenticatedIdentities": true,
+  "resourceNameTruncated": "extaut87063394",
+  "userPoolName": "extauth387063394_userpool_87063394",
+  "autoVerifiedAttributes": ["email"],
+  "mfaConfiguration": "ON",
+  "mfaTypes": ["SMS Text Message", "TOTP"],
+  "smsAuthenticationMessage": "Your authentication code is {####}",
+  "smsVerificationMessage": "Your verification code is {####}",
+  "emailVerificationSubject": "Your verification code",
+  "emailVerificationMessage": "Your verification code is {####}",
+  "defaultPasswordPolicy": true,
+  "passwordPolicyMinLength": 8,
+  "passwordPolicyCharacters": ["Requires Lowercase", "Requires Uppercase", "Requires Numbers", "Requires Symbols"],
+  "requiredAttributes": ["email"],
+  "userpoolClientGenerateSecret": false,
+  "userpoolClientRefreshTokenValidity": 30,
+  "userpoolClientWriteAttributes": ["address", "email"],
+  "userpoolClientReadAttributes": ["address", "email"],
+  "userpoolClientLambdaRole": "extaut87063394_userpoolclient_lambda_role",
+  "userpoolClientSetAttributes": true,
+  "sharedId": "87063394",
+  "resourceName": "extauth38706339487063394",
+  "authSelections": "identityPoolAndUserPool",
+  "authRoleArn": {
+    "Fn::GetAtt": ["AuthRole", "Arn"]
+  },
+  "unauthRoleArn": {
+    "Fn::GetAtt": ["UnauthRole", "Arn"]
+  },
+  "useDefault": "manual",
+  "thirdPartyAuth": true,
+  "authProviders": ["graph.facebook.com", "accounts.google.com", "www.amazon.com", "appleid.apple.com"],
+  "facebookAppId": "dfvsdcsdc",
+  "googleClientId": "svsdvsv",
+  "amazonAppId": "sdsafggas",
+  "appleAppId": "gfdbvafergew",
+  "userPoolGroups": true,
+  "adminQueries": false,
+  "triggers": {
+    "CreateAuthChallenge": ["captcha-create-challenge"],
+    "CustomMessage": ["verification-link"],
+    "DefineAuthChallenge": ["captcha-define-challenge"],
+    "PostAuthentication": ["custom"],
+    "PostConfirmation": ["add-to-group"],
+    "PreAuthentication": ["custom"],
+    "PreSignup": ["email-filter-allowlist"],
+    "VerifyAuthChallengeResponse": ["captcha-verify"],
+    "PreTokenGeneration": ["alter-claims"]
+  },
+  "hostedUI": true,
+  "hostedUIDomainName": "extauth387063394-87063394",
+  "newCallbackURLs": ["https://localhost:3000/"],
+  "newLogoutURLs": ["https://localhost:3000/"],
+  "AllowedOAuthFlows": "code",
+  "AllowedOAuthScopes": ["phone", "email", "openid", "profile", "aws.cognito.signin.user.admin"],
+  "authProvidersUserPool": ["Facebook", "Google", "LoginWithAmazon", "SignInWithApple"],
+  "facebookAppIdUserPool": "sdcsdc",
+  "facebookAppSecretUserPool": "bfdsvsr",
+  "googleAppIdUserPool": "avearver",
+  "googleAppSecretUserPool": "vcvereger",
+  "loginwithamazonAppIdUserPool": "vercvdsavcer",
+  "loginwithamazonAppSecretUserPool": "revfdsavrtv",
+  "signinwithappleClientIdUserPool": "vfdvergver",
+  "signinwithappleTeamIdUserPool": "ervervre",
+  "signinwithappleKeyIdUserPool": "vfdavervfer",
+  "signinwithapplePrivateKeyUserPool": "vaveb",
+  "selectedParties": "{\"graph.facebook.com\":\"dfvsdcsdc\",\"accounts.google.com\":\"svsdvsv\",\"www.amazon.com\":\"sdsafggas\",\"appleid.apple.com\":\"gfdbvafergew\"}",
+  "hostedUIProviderMeta": "[{\"ProviderName\":\"Facebook\",\"authorize_scopes\":\"email,public_profile\",\"AttributeMapping\":{\"email\":\"email\",\"username\":\"id\"}},{\"ProviderName\":\"Google\",\"authorize_scopes\":\"openid email profile\",\"AttributeMapping\":{\"email\":\"email\",\"username\":\"sub\"}},{\"ProviderName\":\"LoginWithAmazon\",\"authorize_scopes\":\"profile profile:user_id\",\"AttributeMapping\":{\"email\":\"email\",\"username\":\"user_id\"}},{\"ProviderName\":\"SignInWithApple\",\"authorize_scopes\":\"email\",\"AttributeMapping\":{\"email\":\"email\"}}]",
+  "hostedUIProviderCreds": "[{\"ProviderName\":\"Facebook\",\"client_id\":\"sdcsdc\",\"client_secret\":\"bfdsvsr\"},{\"ProviderName\":\"Google\",\"client_id\":\"avearver\",\"client_secret\":\"vcvereger\"},{\"ProviderName\":\"LoginWithAmazon\",\"client_id\":\"vercvdsavcer\",\"client_secret\":\"revfdsavrtv\"},{\"ProviderName\":\"SignInWithApple\",\"client_id\":\"vfdvergver\",\"team_id\":\"ervervre\",\"key_id\":\"vfdavervfer\",\"private_key\":\"vaveb\"}]",
+  "oAuthMetadata": "{\"AllowedOAuthFlows\":[\"code\"],\"AllowedOAuthScopes\":[\"phone\",\"email\",\"openid\",\"profile\",\"aws.cognito.signin.user.admin\"],\"CallbackURLs\":[\"https://localhost:3000/\"],\"LogoutURLs\":[\"https://localhost:3000/\"]}",
+  "userPoolGroupList": ["adin"],
+  "serviceName": "Cognito",
+  "verificationBucketName": "extauth38706339487063394verificationbucket",
+  "usernameCaseSensitive": false
+}
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-inputs-manager/auth-input-state.test.ts b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-inputs-manager/auth-input-state.test.ts
new file mode 100644
index 00000000000..7004caa3338
--- /dev/null
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-inputs-manager/auth-input-state.test.ts
@@ -0,0 +1,109 @@
+import { AuthInputState } from '../../../../provider-utils/awscloudformation/auth-inputs-manager/auth-input-state';
+
+jest.mock('fs-extra');
+
+jest.mock('amplify-cli-core', () => ({
+  ...(jest.requireActual('amplify-cli-core') as {}),
+  pathManager: {
+    getBackendDirPath: jest.fn().mockReturnValue('mockbackendDirPath'),
+    findProjectRoot: jest.fn().mockReturnValue('mockProject'),
+  },
+  JSONUtilities: {
+    readJson: jest
+      .fn()
+      .mockReturnValueOnce({
+        cognitoConfig: {
+          identityPoolName: 'extauth387063394_identitypool_87063394',
+          allowUnauthenticatedIdentities: true,
+          resourceNameTruncated: 'extaut87063394',
+          userPoolName: 'extauth387063394_userpool_87063394',
+          autoVerifiedAttributes: ['email'],
+          mfaConfiguration: 'ON',
+          mfaTypes: ['SMS Text Message', 'TOTP'],
+          smsAuthenticationMessage: 'Your authentication code is {####}',
+          smsVerificationMessage: 'Your verification code is {####}',
+          emailVerificationSubject: 'Your verification code',
+          emailVerificationMessage: 'Your verification code is {####}',
+          defaultPasswordPolicy: true,
+          passwordPolicyMinLength: 8,
+          passwordPolicyCharacters: ['Requires Lowercase', 'Requires Uppercase', 'Requires Numbers', 'Requires Symbols'],
+          requiredAttributes: ['email'],
+          userpoolClientRefreshTokenValidity: 30,
+          userpoolClientWriteAttributes: ['address', 'email'],
+          userpoolClientReadAttributes: ['address', 'email'],
+          userpoolClientLambdaRole: 'extaut87063394_userpoolclient_lambda_role',
+          userpoolClientSetAttributes: true,
+          userpoolClientGenerateSecret: false,
+          sharedId: '87063394',
+          resourceName: 'extauth38706339487063394',
+          authSelections: 'identityPoolAndUserPool',
+          authRoleArn: {
+            'Fn::GetAtt': ['AuthRole', 'Arn'],
+          },
+          unauthRoleArn: {
+            'Fn::GetAtt': ['UnauthRole', 'Arn'],
+          },
+          useDefault: 'manual',
+          thirdPartyAuth: true,
+          authProviders: ['graph.facebook.com', 'accounts.google.com', 'www.amazon.com', 'appleid.apple.com'],
+          facebookAppId: 'dfvsdcsdc',
+          googleClientId: 'svsdvsv',
+          amazonAppId: 'sdsafggas',
+          appleAppId: 'gfdbvafergew',
+          userPoolGroups: true,
+          adminQueries: false,
+          triggers: {
+            CreateAuthChallenge: ['captcha-create-challenge'],
+            CustomMessage: ['verification-link'],
+            DefineAuthChallenge: ['captcha-define-challenge'],
+            PostAuthentication: ['custom'],
+            PostConfirmation: ['add-to-group'],
+            PreAuthentication: ['custom'],
+            PreSignup: ['email-filter-allowlist'],
+            VerifyAuthChallengeResponse: ['captcha-verify'],
+            PreTokenGeneration: ['alter-claims'],
+          },
+          hostedUI: true,
+          hostedUIDomainName: 'extauth387063394-87063394',
+          newCallbackURLs: ['https://localhost:3000/'],
+          newLogoutURLs: ['https://localhost:3000/'],
+          AllowedOAuthFlows: 'code',
+          AllowedOAuthScopes: ['phone', 'email', 'openid', 'profile', 'aws.cognito.signin.user.admin'],
+          authProvidersUserPool: ['Facebook', 'Google', 'LoginWithAmazon', 'SignInWithApple'],
+          facebookAppIdUserPool: 'sdcsdc',
+          facebookAppSecretUserPool: 'bfdsvsr',
+          googleAppIdUserPool: 'avearver',
+          googleAppSecretUserPool: 'vcvereger',
+          loginwithamazonAppIdUserPool: 'vercvdsavcer',
+          loginwithamazonAppSecretUserPool: 'revfdsavrtv',
+          signinwithappleClientIdUserPool: 'vfdvergver',
+          signinwithappleTeamIdUserPool: 'ervervre',
+          signinwithappleKeyIdUserPool: 'vfdavervfer',
+          signinwithapplePrivateKeyUserPool: 'vaveb',
+          selectedParties:
+            '{"graph.facebook.com":"dfvsdcsdc","accounts.google.com":"svsdvsv","www.amazon.com":"sdsafggas","appleid.apple.com":"gfdbvafergew"}',
+          hostedUIProviderMeta:
+            '[{"ProviderName":"Facebook","authorize_scopes":"email,public_profile","AttributeMapping":{"email":"email","username":"id"}},{"ProviderName":"Google","authorize_scopes":"openid email profile","AttributeMapping":{"email":"email","username":"sub"}},{"ProviderName":"LoginWithAmazon","authorize_scopes":"profile profile:user_id","AttributeMapping":{"email":"email","username":"user_id"}},{"ProviderName":"SignInWithApple","authorize_scopes":"email","AttributeMapping":{"email":"email"}}]',
+          oAuthMetadata:
+            '{"AllowedOAuthFlows":["code"],"AllowedOAuthScopes":["phone","email","openid","profile","aws.cognito.signin.user.admin"],"CallbackURLs":["https://localhost:3000/"],"LogoutURLs":["https://localhost:3000/"]}',
+          userPoolGroupList: ['adin'],
+          serviceName: 'Cognito',
+          verificationBucketName: 'extauth38706339487063394verificationbucket',
+          usernameCaseSensitive: false,
+        },
+      })
+      .mockReturnValueOnce({}),
+  },
+}));
+
+test('Auth Input State -> validate cli payload manual payload', async () => {
+  const resourceName = 'mockResource';
+  const authState = new AuthInputState(resourceName);
+  expect(await authState.isCLIInputsValid()).toBe(true);
+});
+
+test('Auth Input State -> validate cli payload manual payload to throw error', async () => {
+  const resourceName = 'mockResource';
+  const authState = new AuthInputState(resourceName);
+  expect(authState.isCLIInputsValid()).rejects.toThrowError();
+});
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/__snapshots__/auth-stack-transform.test.ts.snap b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/__snapshots__/auth-stack-transform.test.ts.snap
new file mode 100644
index 00000000000..899f197e174
--- /dev/null
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/__snapshots__/auth-stack-transform.test.ts.snap
@@ -0,0 +1,2486 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Check Auth Template Generated authstack template in default flow 1`] = `
+Object {
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Conditions": Object {
+    "ShouldNotCreateEnvResources": Object {
+      "Fn::Equals": Array [
+        Object {
+          "Ref": "env",
+        },
+        "NONE",
+      ],
+    },
+    "ShouldOutputAppClientSecrets": Object {
+      "Fn::Equals": Array [
+        Object {
+          "Ref": "userpoolClientGenerateSecret",
+        },
+        true,
+      ],
+    },
+  },
+  "Description": "Amplify Cognito Stack for AWS Amplify CLI",
+  "Outputs": Object {
+    "AppClientID": Object {
+      "Description": "The user pool app client id",
+      "Value": Object {
+        "Ref": "UserPoolClient",
+      },
+    },
+    "AppClientIDWeb": Object {
+      "Description": "The user pool app client id for web",
+      "Value": Object {
+        "Ref": "UserPoolClientWeb",
+      },
+    },
+    "AppClientSecret": Object {
+      "Condition": "ShouldOutputAppClientSecrets",
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "UserPoolClientInputs",
+          "appSecret",
+        ],
+      },
+    },
+    "IdentityPoolId": Object {
+      "Description": "Id for the identity pool",
+      "Value": Object {
+        "Ref": "IdentityPool",
+      },
+    },
+    "IdentityPoolName": Object {
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "IdentityPool",
+          "Name",
+        ],
+      },
+    },
+    "UserPoolArn": Object {
+      "Description": "Arn for the user pool",
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "UserPool",
+          "Arn",
+        ],
+      },
+    },
+    "UserPoolId": Object {
+      "Description": "Id for the user pool",
+      "Value": Object {
+        "Ref": "UserPool",
+      },
+    },
+    "UserPoolName": Object {
+      "Value": Object {
+        "Ref": "userPoolName",
+      },
+    },
+  },
+  "Parameters": Object {
+    "aliasAttributes": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "allowUnauthenticatedIdentities": Object {
+      "Type": "String",
+    },
+    "authRoleArn": Object {
+      "Type": "String",
+    },
+    "authSelections": Object {
+      "Type": "String",
+    },
+    "autoVerifiedAttributes": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "breakCircularDependency": Object {
+      "Type": "String",
+    },
+    "defaultPasswordPolicy": Object {
+      "Type": "String",
+    },
+    "dependsOn": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "emailVerificationMessage": Object {
+      "Type": "String",
+    },
+    "emailVerificationSubject": Object {
+      "Type": "String",
+    },
+    "env": Object {
+      "Type": "String",
+    },
+    "identityPoolName": Object {
+      "Type": "String",
+    },
+    "mfaConfiguration": Object {
+      "Type": "String",
+    },
+    "mfaTypes": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "passwordPolicyCharacters": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "passwordPolicyMinLength": Object {
+      "Type": "String",
+    },
+    "requiredAttributes": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "resourceName": Object {
+      "Type": "String",
+    },
+    "resourceNameTruncated": Object {
+      "Type": "String",
+    },
+    "serviceName": Object {
+      "Type": "String",
+    },
+    "sharedId": Object {
+      "Type": "String",
+    },
+    "smsAuthenticationMessage": Object {
+      "Type": "String",
+    },
+    "smsVerificationMessage": Object {
+      "Type": "String",
+    },
+    "unauthRoleArn": Object {
+      "Type": "String",
+    },
+    "useDefault": Object {
+      "Type": "String",
+    },
+    "userPoolGroupList": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "userPoolName": Object {
+      "Type": "String",
+    },
+    "usernameCaseSensitive": Object {
+      "Type": "String",
+    },
+    "userpoolClientGenerateSecret": Object {
+      "Type": "String",
+    },
+    "userpoolClientLambdaRole": Object {
+      "Type": "String",
+    },
+    "userpoolClientReadAttributes": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "userpoolClientRefreshTokenValidity": Object {
+      "Type": "String",
+    },
+    "userpoolClientSetAttributes": Object {
+      "Type": "String",
+    },
+    "userpoolClientWriteAttributes": Object {
+      "Type": "CommaDelimitedList",
+    },
+  },
+  "Resources": Object {
+    "IdentityPool": Object {
+      "DependsOn": Array [
+        "UserPoolClientInputs",
+      ],
+      "Properties": Object {
+        "AllowUnauthenticatedIdentities": Object {
+          "Ref": "allowUnauthenticatedIdentities",
+        },
+        "CognitoIdentityProviders": Array [
+          Object {
+            "ClientId": Object {
+              "Ref": "UserPoolClient",
+            },
+            "ProviderName": Object {
+              "Fn::Sub": Array [
+                "cognito-idp.\${region}.amazonaws.com/\${client}",
+                Object {
+                  "client": Object {
+                    "Ref": "UserPool",
+                  },
+                  "region": Object {
+                    "Ref": "AWS::Region",
+                  },
+                },
+              ],
+            },
+          },
+          Object {
+            "ClientId": Object {
+              "Ref": "UserPoolClientWeb",
+            },
+            "ProviderName": Object {
+              "Fn::Sub": Array [
+                "cognito-idp.\${region}.amazonaws.com/\${client}",
+                Object {
+                  "client": Object {
+                    "Ref": "UserPool",
+                  },
+                  "region": Object {
+                    "Ref": "AWS::Region",
+                  },
+                },
+              ],
+            },
+          },
+        ],
+        "IdentityPoolName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            "authdefaultsettings2c33facd_identitypool_2c33facd",
+            Object {
+              "Fn::Join": Array [
+                "",
+                Array [
+                  "authdefaultsettings2c33facd_identitypool_2c33facd-",
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+      },
+      "Type": "AWS::Cognito::IdentityPool",
+    },
+    "IdentityPoolRoleMap": Object {
+      "DependsOn": Array [
+        "IdentityPool",
+      ],
+      "Properties": Object {
+        "IdentityPoolId": Object {
+          "Ref": "IdentityPool",
+        },
+        "Roles": Object {
+          "authenticated": Object {
+            "Ref": "authRoleArn",
+          },
+          "unauthenticated": Object {
+            "Ref": "unauthRoleArn",
+          },
+        },
+      },
+      "Type": "AWS::Cognito::IdentityPoolRoleAttachment",
+    },
+    "SNSRole": Object {
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "sts:AssumeRole",
+              ],
+              "Condition": Object {
+                "StringEquals": Object {
+                  "sts:ExternalId": "authde2c33facd_role_external_id",
+                },
+              },
+              "Effect": "Allow",
+              "Principal": Object {
+                "Service": "cognito-idp.amazonaws.com",
+              },
+              "Sid": "",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "Policies": Array [
+          Object {
+            "PolicyDocument": Object {
+              "Statement": Array [
+                Object {
+                  "Action": Array [
+                    "sns:Publish",
+                  ],
+                  "Effect": "Allow",
+                  "Resource": "*",
+                },
+              ],
+              "Version": "2012-10-17",
+            },
+            "PolicyName": "authde2c33facd-sns-policy",
+          },
+        ],
+        "RoleName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            "authde2c33facd_sns-role",
+            Object {
+              "Fn::Join": Array [
+                "",
+                Array [
+                  "sns2c33facd",
+                  Object {
+                    "Fn::Select": Array [
+                      3,
+                      Object {
+                        "Fn::Split": Array [
+                          "-",
+                          Object {
+                            "Ref": "AWS::StackName",
+                          },
+                        ],
+                      },
+                    ],
+                  },
+                  "-",
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+    "UserPool": Object {
+      "DeletionPolicy": "Retain",
+      "Properties": Object {
+        "AliasAttributes": Object {
+          "Ref": "aliasAttributes",
+        },
+        "AutoVerifiedAttributes": Array [
+          "email",
+        ],
+        "EmailVerificationMessage": Object {
+          "Ref": "emailVerificationMessage",
+        },
+        "EmailVerificationSubject": Object {
+          "Ref": "emailVerificationSubject",
+        },
+        "MfaConfiguration": Object {
+          "Ref": "mfaConfiguration",
+        },
+        "Policies": Object {
+          "PasswordPolicy": Object {
+            "MinimumLength": Object {
+              "Ref": "passwordPolicyMinLength",
+            },
+            "RequireLowercase": false,
+            "RequireNumbers": false,
+            "RequireSymbols": false,
+            "RequireUppercase": false,
+          },
+        },
+        "Schema": Array [
+          Object {
+            "Mutable": true,
+            "Name": "email",
+            "Required": true,
+          },
+        ],
+        "SmsAuthenticationMessage": Object {
+          "Ref": "smsAuthenticationMessage",
+        },
+        "SmsConfiguration": Object {
+          "ExternalId": "authde2c33facd_role_external_id",
+          "SnsCallerArn": Object {
+            "Fn::GetAtt": Array [
+              "SNSRole",
+              "Arn",
+            ],
+          },
+        },
+        "SmsVerificationMessage": Object {
+          "Ref": "smsVerificationMessage",
+        },
+        "UserPoolName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            Object {
+              "Ref": "userPoolName",
+            },
+            Object {
+              "Fn::Join": Array [
+                "",
+                Array [
+                  Object {
+                    "Ref": "userPoolName",
+                  },
+                  "-",
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+        "UsernameConfiguration": Object {
+          "CaseSensitive": false,
+        },
+      },
+      "Type": "AWS::Cognito::UserPool",
+      "UpdateReplacePolicy": "Retain",
+    },
+    "UserPoolClient": Object {
+      "DependsOn": Array [
+        "UserPool",
+      ],
+      "Properties": Object {
+        "ClientName": "authde2c33facd_app_client",
+        "GenerateSecret": Object {
+          "Ref": "userpoolClientGenerateSecret",
+        },
+        "RefreshTokenValidity": Object {
+          "Ref": "userpoolClientRefreshTokenValidity",
+        },
+        "UserPoolId": Object {
+          "Ref": "UserPool",
+        },
+      },
+      "Type": "AWS::Cognito::UserPoolClient",
+    },
+    "UserPoolClientInputs": Object {
+      "DeletionPolicy": "Delete",
+      "DependsOn": Array [
+        "UserPoolClientLogPolicy",
+      ],
+      "Properties": Object {
+        "ServiceToken": Object {
+          "Fn::GetAtt": Array [
+            "UserPoolClientLambda",
+            "Arn",
+          ],
+        },
+        "clientId": Object {
+          "Ref": "UserPoolClient",
+        },
+        "userpoolId": Object {
+          "Ref": "UserPool",
+        },
+      },
+      "Type": "Custom::LambdaCallout",
+      "UpdateReplacePolicy": "Delete",
+    },
+    "UserPoolClientLambda": Object {
+      "DependsOn": Array [
+        "UserPoolClientRole",
+      ],
+      "Properties": Object {
+        "Code": Object {
+          "ZipFile": "const response = require('cfn-response');
+const aws = require('aws-sdk');
+const identity = new aws.CognitoIdentityServiceProvider();
+exports.handler = (event, context, callback) => {
+  if (event.RequestType == 'Delete') {
+    response.send(event, context, response.SUCCESS, {});
+  }
+  if (event.RequestType == 'Update' || event.RequestType == 'Create') {
+    const params = {
+      ClientId: event.ResourceProperties.clientId,
+      UserPoolId: event.ResourceProperties.userpoolId,
+    };
+    identity
+      .describeUserPoolClient(params)
+      .promise()
+      .then(res => {
+        response.send(event, context, response.SUCCESS, { appSecret: res.UserPoolClient.ClientSecret });
+      })
+      .catch(err => {
+        response.send(event, context, response.FAILED, { err });
+      });
+  }
+};
+",
+        },
+        "Handler": "index.handler",
+        "Role": Object {
+          "Fn::GetAtt": Array [
+            "UserPoolClientRole",
+            "Arn",
+          ],
+        },
+        "Runtime": "nodejs12.x",
+        "Timeout": 300,
+      },
+      "Type": "AWS::Lambda::Function",
+    },
+    "UserPoolClientLambdaPolicy": Object {
+      "DependsOn": Array [
+        "UserPoolClientLambda",
+      ],
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "cognito-idp:DescribeUserPoolClient",
+              ],
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::GetAtt": Array [
+                  "UserPool",
+                  "Arn",
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": "authde2c33facd_userpoolclient_lambda_iam_policy",
+        "Roles": Array [
+          Object {
+            "Ref": "UserPoolClientRole",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "UserPoolClientLogPolicy": Object {
+      "DependsOn": Array [
+        "UserPoolClientLambdaPolicy",
+      ],
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "logs:CreateLogGroup",
+                "logs:CreateLogStream",
+                "logs:PutLogEvents",
+              ],
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::Sub": Array [
+                  "arn:aws:logs:\${region}:\${account}:log-group:/aws/lambda/\${lambda}:log-stream:*",
+                  Object {
+                    "account": Object {
+                      "Ref": "AWS::AccountId",
+                    },
+                    "lambda": Object {
+                      "Ref": "UserPoolClientLambda",
+                    },
+                    "region": Object {
+                      "Ref": "AWS::Region",
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": "authde2c33facd_userpoolclient_lambda_log_policy",
+        "Roles": Array [
+          Object {
+            "Ref": "UserPoolClientRole",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "UserPoolClientRole": Object {
+      "DependsOn": Array [
+        "UserPoolClient",
+      ],
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": Object {
+                "Service": "lambda.amazonaws.com",
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "RoleName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            Object {
+              "Ref": "userpoolClientLambdaRole",
+            },
+            Object {
+              "Fn::Join": Array [
+                "",
+                Array [
+                  "upClientLambdaRole2c33facd",
+                  Object {
+                    "Fn::Select": Array [
+                      3,
+                      Object {
+                        "Fn::Split": Array [
+                          "-",
+                          Object {
+                            "Ref": "AWS::StackName",
+                          },
+                        ],
+                      },
+                    ],
+                  },
+                  "-",
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+    "UserPoolClientWeb": Object {
+      "DependsOn": Array [
+        "UserPool",
+      ],
+      "Properties": Object {
+        "ClientName": "authde2c33facd_app_clientWeb",
+        "RefreshTokenValidity": Object {
+          "Ref": "userpoolClientRefreshTokenValidity",
+        },
+        "UserPoolId": Object {
+          "Ref": "UserPool",
+        },
+      },
+      "Type": "AWS::Cognito::UserPoolClient",
+    },
+  },
+}
+`;
+
+exports[`Check Auth Template Generated authstack template in manual flow 1`] = `
+Object {
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Conditions": Object {
+    "ShouldNotCreateEnvResources": Object {
+      "Fn::Equals": Array [
+        Object {
+          "Ref": "env",
+        },
+        "NONE",
+      ],
+    },
+    "ShouldOutputAppClientSecrets": Object {
+      "Fn::Equals": Array [
+        Object {
+          "Ref": "userpoolClientGenerateSecret",
+        },
+        true,
+      ],
+    },
+  },
+  "Description": "Amplify Cognito Stack for AWS Amplify CLI",
+  "Outputs": Object {
+    "AmazonWebClient": Object {
+      "Value": Object {
+        "Ref": "amazonAppId",
+      },
+    },
+    "AppClientID": Object {
+      "Description": "The user pool app client id",
+      "Value": Object {
+        "Ref": "UserPoolClient",
+      },
+    },
+    "AppClientIDWeb": Object {
+      "Description": "The user pool app client id for web",
+      "Value": Object {
+        "Ref": "UserPoolClientWeb",
+      },
+    },
+    "AppClientSecret": Object {
+      "Condition": "ShouldOutputAppClientSecrets",
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "UserPoolClientInputs",
+          "appSecret",
+        ],
+      },
+    },
+    "AppleWebClient": Object {
+      "Value": Object {
+        "Ref": "appleAppId",
+      },
+    },
+    "CreatedSNSRole": Object {
+      "Description": "role arn",
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "SNSRole",
+          "Arn",
+        ],
+      },
+    },
+    "FacebookWebClient": Object {
+      "Value": Object {
+        "Ref": "facebookAppId",
+      },
+    },
+    "GoogleWebClient": Object {
+      "Value": Object {
+        "Ref": "googleClientId",
+      },
+    },
+    "HostedUIDomain": Object {
+      "Value": Object {
+        "Fn::If": Array [
+          "ShouldNotCreateEnvResources",
+          Object {
+            "Ref": "hostedUIDomainName",
+          },
+          Object {
+            "Fn::Join": Array [
+              "-",
+              Array [
+                Object {
+                  "Ref": "hostedUIDomainName",
+                },
+                Object {
+                  "Ref": "env",
+                },
+              ],
+            ],
+          },
+        ],
+      },
+    },
+    "IdentityPoolId": Object {
+      "Description": "Id for the identity pool",
+      "Value": Object {
+        "Ref": "IdentityPool",
+      },
+    },
+    "IdentityPoolName": Object {
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "IdentityPool",
+          "Name",
+        ],
+      },
+    },
+    "OAuthMetadata": Object {
+      "Value": Object {
+        "Ref": "oAuthMetadata",
+      },
+    },
+    "UserPoolArn": Object {
+      "Description": "Arn for the user pool",
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "UserPool",
+          "Arn",
+        ],
+      },
+    },
+    "UserPoolId": Object {
+      "Description": "Id for the user pool",
+      "Value": Object {
+        "Ref": "UserPool",
+      },
+    },
+    "UserPoolName": Object {
+      "Value": Object {
+        "Ref": "userPoolName",
+      },
+    },
+  },
+  "Parameters": Object {
+    "AllowedOAuthFlows": Object {
+      "Type": "String",
+    },
+    "AllowedOAuthScopes": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "adminQueries": Object {
+      "Type": "String",
+    },
+    "allowUnauthenticatedIdentities": Object {
+      "Type": "String",
+    },
+    "amazonAppId": Object {
+      "Type": "String",
+    },
+    "appleAppId": Object {
+      "Type": "String",
+    },
+    "authProviders": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "authProvidersUserPool": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "authRoleArn": Object {
+      "Type": "String",
+    },
+    "authSelections": Object {
+      "Type": "String",
+    },
+    "authTriggerConnections": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "autoVerifiedAttributes": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "breakCircularDependency": Object {
+      "Type": "String",
+    },
+    "defaultPasswordPolicy": Object {
+      "Type": "String",
+    },
+    "emailVerificationMessage": Object {
+      "Type": "String",
+    },
+    "emailVerificationSubject": Object {
+      "Type": "String",
+    },
+    "env": Object {
+      "Type": "String",
+    },
+    "facebookAppId": Object {
+      "Type": "String",
+    },
+    "facebookAppIdUserPool": Object {
+      "Type": "String",
+    },
+    "facebookAppSecretUserPool": Object {
+      "Type": "String",
+    },
+    "googleAppIdUserPool": Object {
+      "Type": "String",
+    },
+    "googleAppSecretUserPool": Object {
+      "Type": "String",
+    },
+    "googleClientId": Object {
+      "Type": "String",
+    },
+    "hostedUI": Object {
+      "Type": "String",
+    },
+    "hostedUIDomainName": Object {
+      "Type": "String",
+    },
+    "hostedUIProviderCreds": Object {
+      "Type": "String",
+    },
+    "hostedUIProviderMeta": Object {
+      "Type": "String",
+    },
+    "identityPoolName": Object {
+      "Type": "String",
+    },
+    "loginwithamazonAppIdUserPool": Object {
+      "Type": "String",
+    },
+    "loginwithamazonAppSecretUserPool": Object {
+      "Type": "String",
+    },
+    "mfaConfiguration": Object {
+      "Type": "String",
+    },
+    "mfaTypes": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "newCallbackURLs": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "newLogoutURLs": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "oAuthMetadata": Object {
+      "Type": "String",
+    },
+    "passwordPolicyCharacters": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "passwordPolicyMinLength": Object {
+      "Type": "String",
+    },
+    "requiredAttributes": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "resourceName": Object {
+      "Type": "String",
+    },
+    "resourceNameTruncated": Object {
+      "Type": "String",
+    },
+    "selectedParties": Object {
+      "Type": "String",
+    },
+    "serviceName": Object {
+      "Type": "String",
+    },
+    "sharedId": Object {
+      "Type": "String",
+    },
+    "signinwithappleClientIdUserPool": Object {
+      "Type": "String",
+    },
+    "signinwithappleKeyIdUserPool": Object {
+      "Type": "String",
+    },
+    "signinwithapplePrivateKeyUserPool": Object {
+      "Type": "String",
+    },
+    "signinwithappleTeamIdUserPool": Object {
+      "Type": "String",
+    },
+    "smsAuthenticationMessage": Object {
+      "Type": "String",
+    },
+    "smsVerificationMessage": Object {
+      "Type": "String",
+    },
+    "thirdPartyAuth": Object {
+      "Type": "String",
+    },
+    "triggers": Object {
+      "Type": "String",
+    },
+    "unauthRoleArn": Object {
+      "Type": "String",
+    },
+    "useDefault": Object {
+      "Type": "String",
+    },
+    "userPoolGroups": Object {
+      "Type": "String",
+    },
+    "userPoolName": Object {
+      "Type": "String",
+    },
+    "usernameCaseSensitive": Object {
+      "Type": "String",
+    },
+    "userpoolClientGenerateSecret": Object {
+      "Type": "String",
+    },
+    "userpoolClientLambdaRole": Object {
+      "Type": "String",
+    },
+    "userpoolClientReadAttributes": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "userpoolClientRefreshTokenValidity": Object {
+      "Type": "String",
+    },
+    "userpoolClientSetAttributes": Object {
+      "Type": "String",
+    },
+    "userpoolClientWriteAttributes": Object {
+      "Type": "CommaDelimitedList",
+    },
+    "verificationBucketName": Object {
+      "Type": "String",
+    },
+  },
+  "Resources": Object {
+    "CustomMessageConfirmationBucket": Object {
+      "DeletionPolicy": "Retain",
+      "Properties": Object {
+        "AccessControl": "Private",
+        "BucketName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            Object {
+              "Ref": "verificationBucketName",
+            },
+            Object {
+              "Fn::Join": Array [
+                "-",
+                Array [
+                  Object {
+                    "Ref": "verificationBucketName",
+                  },
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+        "CorsConfiguration": Object {
+          "CorsRules": Array [
+            Object {
+              "AllowedHeaders": Array [
+                "Authorization",
+                "Content-length",
+              ],
+              "AllowedMethods": Array [
+                "GET",
+              ],
+              "AllowedOrigins": Array [
+                "*",
+              ],
+              "MaxAge": 3000,
+            },
+          ],
+        },
+      },
+      "Type": "AWS::S3::Bucket",
+      "UpdateReplacePolicy": "Retain",
+    },
+    "HostedUICustomResource": Object {
+      "DependsOn": Array [
+        "UserPoolClientRole",
+      ],
+      "Properties": Object {
+        "Code": Object {
+          "ZipFile": "const response = require('cfn-response');
+const aws = require('aws-sdk');
+const identity = new aws.CognitoIdentityServiceProvider();
+exports.handler = (event, context, callback) => {
+  const userPoolId = event.ResourceProperties.userPoolId;
+  const inputDomainName = event.ResourceProperties.hostedUIDomainName;
+  let deleteUserPoolDomain = domainName => {
+    let params = { Domain: domainName, UserPoolId: userPoolId };
+    return identity.deleteUserPoolDomain(params).promise();
+  };
+  if (event.RequestType == 'Delete') {
+    deleteUserPoolDomain(inputDomainName)
+      .then(() => {
+        response.send(event, context, response.SUCCESS, {});
+      })
+      .catch(err => {
+        console.log(err);
+        response.send(event, context, response.FAILED, { err });
+      });
+  }
+  if (event.RequestType == 'Update' || event.RequestType == 'Create') {
+    let checkDomainAvailability = domainName => {
+      let params = { Domain: domainName };
+      return identity
+        .describeUserPoolDomain(params)
+        .promise()
+        .then(res => {
+          if (res.DomainDescription && res.DomainDescription.UserPool) {
+            return false;
+          }
+          return true;
+        })
+        .catch(err => {
+          return false;
+        });
+    };
+    let createUserPoolDomain = domainName => {
+      let params = { Domain: domainName, UserPoolId: userPoolId };
+      return identity.createUserPoolDomain(params).promise();
+    };
+    identity
+      .describeUserPool({ UserPoolId: userPoolId })
+      .promise()
+      .then(result => {
+        if (inputDomainName) {
+          if (result.UserPool.Domain === inputDomainName) {
+            return;
+          } else {
+            if (!result.UserPool.Domain) {
+              return checkDomainAvailability(inputDomainName).then(isDomainAvailable => {
+                if (isDomainAvailable) {
+                  return createUserPoolDomain(inputDomainName);
+                } else {
+                  throw new Error('Domain not available');
+                }
+              });
+            } else {
+              return checkDomainAvailability(inputDomainName).then(isDomainAvailable => {
+                if (isDomainAvailable) {
+                  return deleteUserPoolDomain(result.UserPool.Domain).then(() => createUserPoolDomain(inputDomainName));
+                } else {
+                  throw new Error('Domain not available');
+                }
+              });
+            }
+          }
+        } else {
+          if (result.UserPool.Domain) {
+            return deleteUserPoolDomain(result.UserPool.Domain);
+          }
+        }
+      })
+      .then(() => {
+        response.send(event, context, response.SUCCESS, {});
+      })
+      .catch(err => {
+        console.log(err);
+        response.send(event, context, response.FAILED, { err });
+      });
+  }
+};
+",
+        },
+        "Handler": "index.handler",
+        "Role": Object {
+          "Fn::GetAtt": Array [
+            "UserPoolClientRole",
+            "Arn",
+          ],
+        },
+        "Runtime": "nodejs12.x",
+        "Timeout": 300,
+      },
+      "Type": "AWS::Lambda::Function",
+    },
+    "HostedUICustomResourceInputs": Object {
+      "DeletionPolicy": "Delete",
+      "DependsOn": Array [
+        "HostedUICustomResourceLogPolicy",
+      ],
+      "Properties": Object {
+        "ServiceToken": Object {
+          "Fn::GetAtt": Array [
+            "HostedUICustomResource",
+            "Arn",
+          ],
+        },
+        "hostedUIDomainName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            Object {
+              "Ref": "hostedUIDomainName",
+            },
+            Object {
+              "Fn::Join": Array [
+                "-",
+                Array [
+                  Object {
+                    "Ref": "hostedUIDomainName",
+                  },
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+        "userPoolId": Object {
+          "Ref": "UserPool",
+        },
+      },
+      "Type": "Custom::LambdaCallout",
+      "UpdateReplacePolicy": "Delete",
+    },
+    "HostedUICustomResourceLogPolicy": Object {
+      "DependsOn": Array [
+        "HostedUICustomResourcePolicy",
+      ],
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "logs:CreateLogGroup",
+                "logs:CreateLogStream",
+                "logs:PutLogEvents",
+              ],
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::Sub": Array [
+                  "arn:aws:logs:\${region}:\${account}:log-group:/aws/lambda/\${lambda}:log-stream:*",
+                  Object {
+                    "account": Object {
+                      "Ref": "AWS::AccountId",
+                    },
+                    "lambda": Object {
+                      "Ref": "HostedUICustomResource",
+                    },
+                    "region": Object {
+                      "Ref": "AWS::Region",
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": Object {
+          "Fn::Join": Array [
+            "-",
+            Array [
+              Object {
+                "Ref": "UserPool",
+              },
+              "hostedUILogPolicy",
+            ],
+          ],
+        },
+        "Roles": Array [
+          Object {
+            "Ref": "UserPoolClientRole",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "HostedUICustomResourcePolicy": Object {
+      "DependsOn": Array [
+        "HostedUICustomResource",
+      ],
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "cognito-idp:CreateUserPoolDomain",
+                "cognito-idp:DescribeUserPool",
+                "cognito-idp:DeleteUserPoolDomain",
+              ],
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::GetAtt": Array [
+                  "UserPool",
+                  "Arn",
+                ],
+              },
+            },
+            Object {
+              "Action": Array [
+                "cognito-idp:DescribeUserPoolDomain",
+              ],
+              "Effect": "Allow",
+              "Resource": "*",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": Object {
+          "Fn::Join": Array [
+            "-",
+            Array [
+              Object {
+                "Ref": "UserPool",
+              },
+              Object {
+                "Ref": "hostedUI",
+              },
+            ],
+          ],
+        },
+        "Roles": Array [
+          Object {
+            "Ref": "UserPoolClientRole",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "HostedUIProvidersCustomResource": Object {
+      "DependsOn": Array [
+        "UserPoolClientRole",
+      ],
+      "Properties": Object {
+        "Code": Object {
+          "ZipFile": "const response = require('cfn-response');
+const aws = require('aws-sdk');
+const identity = new aws.CognitoIdentityServiceProvider();
+exports.handler = (event, context, callback) => {
+  try {
+    const userPoolId = event.ResourceProperties.userPoolId;
+    let hostedUIProviderMeta = JSON.parse(event.ResourceProperties.hostedUIProviderMeta);
+    let hostedUIProviderCreds = JSON.parse(event.ResourceProperties.hostedUIProviderCreds);
+    if (hostedUIProviderCreds.length === 0) {
+      response.send(event, context, response.SUCCESS, {});
+    }
+    if (event.RequestType == 'Delete') {
+      response.send(event, context, response.SUCCESS, {});
+    }
+    if (event.RequestType == 'Update' || event.RequestType == 'Create') {
+      let getRequestParams = providerName => {
+        let providerMetaIndex = hostedUIProviderMeta.findIndex(provider => provider.ProviderName === providerName);
+        let providerMeta = hostedUIProviderMeta[providerMetaIndex];
+        let providerCredsIndex = hostedUIProviderCreds.findIndex(provider => provider.ProviderName === providerName);
+        let providerCreds = hostedUIProviderCreds[providerCredsIndex];
+        let requestParams = {
+          ProviderName: providerMeta.ProviderName,
+          UserPoolId: userPoolId,
+          AttributeMapping: providerMeta.AttributeMapping,
+        };
+        if (providerMeta.ProviderName === 'SignInWithApple') {
+          if (providerCreds.client_id && providerCreds.team_id && providerCreds.key_id && providerCreds.private_key) {
+            requestParams.ProviderDetails = {
+              client_id: providerCreds.client_id,
+              team_id: providerCreds.team_id,
+              key_id: providerCreds.key_id,
+              private_key: providerCreds.private_key,
+              authorize_scopes: providerMeta.authorize_scopes,
+            };
+          } else {
+            requestParams = null;
+          }
+        } else {
+          requestParams.ProviderDetails = {
+            client_id: providerCreds.client_id,
+            client_secret: providerCreds.client_secret,
+            authorize_scopes: providerMeta.authorize_scopes,
+          };
+        }
+        return requestParams;
+      };
+      let createIdentityProvider = providerName => {
+        let requestParams = getRequestParams(providerName);
+        if (!requestParams) {
+          return Promise.resolve();
+        }
+        requestParams.ProviderType = requestParams.ProviderName;
+        return identity.createIdentityProvider(requestParams).promise();
+      };
+      let updateIdentityProvider = providerName => {
+        let requestParams = getRequestParams(providerName);
+        if (!requestParams) {
+          return Promise.resolve();
+        }
+        return identity.updateIdentityProvider(requestParams).promise();
+      };
+      let deleteIdentityProvider = providerName => {
+        let params = { ProviderName: providerName, UserPoolId: userPoolId };
+        return identity.deleteIdentityProvider(params).promise();
+      };
+      let providerPromises = [];
+      identity
+        .listIdentityProviders({ UserPoolId: userPoolId, MaxResults: 60 })
+        .promise()
+        .then(result => {
+          console.log(result);
+          let providerList = result.Providers.map(provider => provider.ProviderName);
+          let providerListInParameters = hostedUIProviderMeta.map(provider => provider.ProviderName);
+          hostedUIProviderMeta.forEach(providerMetadata => {
+            if (providerList.indexOf(providerMetadata.ProviderName) > 1) {
+              providerPromises.push(updateIdentityProvider(providerMetadata.ProviderName));
+            } else {
+              providerPromises.push(createIdentityProvider(providerMetadata.ProviderName));
+            }
+          });
+          providerList.forEach(provider => {
+            if (providerListInParameters.indexOf(provider) < 0) {
+              providerPromises.push(deleteIdentityProvider(provider));
+            }
+          });
+          return Promise.all(providerPromises);
+        })
+        .then(() => {
+          response.send(event, context, response.SUCCESS, {});
+        })
+        .catch(err => {
+          console.log(err.stack);
+          response.send(event, context, response.FAILED, { err });
+        });
+    }
+  } catch (err) {
+    console.log(err.stack);
+    response.send(event, context, response.FAILED, { err });
+  }
+};
+",
+        },
+        "Handler": "index.handler",
+        "Role": Object {
+          "Fn::GetAtt": Array [
+            "UserPoolClientRole",
+            "Arn",
+          ],
+        },
+        "Runtime": "nodejs12.x",
+        "Timeout": 300,
+      },
+      "Type": "AWS::Lambda::Function",
+    },
+    "HostedUIProvidersCustomResourceInputs": Object {
+      "DeletionPolicy": "Delete",
+      "DependsOn": Array [
+        "HostedUIProvidersCustomResourceLogPolicy",
+      ],
+      "Properties": Object {
+        "ServiceToken": Object {
+          "Fn::GetAtt": Array [
+            "HostedUIProvidersCustomResource",
+            "Arn",
+          ],
+        },
+        "hostedUIProviderCreds": Object {
+          "Ref": "hostedUIProviderCreds",
+        },
+        "hostedUIProviderMeta": Object {
+          "Ref": "hostedUIProviderMeta",
+        },
+        "userPoolId": Object {
+          "Ref": "UserPool",
+        },
+      },
+      "Type": "Custom::LambdaCallout",
+      "UpdateReplacePolicy": "Delete",
+    },
+    "HostedUIProvidersCustomResourceLogPolicy": Object {
+      "DependsOn": Array [
+        "HostedUIProvidersCustomResourcePolicy",
+      ],
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "logs:CreateLogGroup",
+                "logs:CreateLogStream",
+                "logs:PutLogEvents",
+              ],
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::Sub": Array [
+                  "arn:aws:logs:\${region}:\${account}:log-group:/aws/lambda/\${lambda}:log-stream:*",
+                  Object {
+                    "account": Object {
+                      "Ref": "AWS::AccountId",
+                    },
+                    "lambda": Object {
+                      "Ref": "HostedUIProvidersCustomResource",
+                    },
+                    "region": Object {
+                      "Ref": "AWS::Region",
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": Object {
+          "Fn::Join": Array [
+            "-",
+            Array [
+              Object {
+                "Ref": "UserPool",
+              },
+              "hostedUIProviderLogPolicy",
+            ],
+          ],
+        },
+        "Roles": Array [
+          Object {
+            "Ref": "UserPoolClientRole",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "HostedUIProvidersCustomResourcePolicy": Object {
+      "DependsOn": Array [
+        "HostedUIProvidersCustomResource",
+      ],
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "cognito-idp:CreateIdentityProvider",
+                "cognito-idp:UpdateIdentityProvider",
+                "cognito-idp:ListIdentityProviders",
+                "cognito-idp:DeleteIdentityProvider",
+              ],
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::GetAtt": Array [
+                  "UserPool",
+                  "Arn",
+                ],
+              },
+            },
+            Object {
+              "Action": Array [
+                "cognito-idp:DescribeUserPoolDomain",
+              ],
+              "Effect": "Allow",
+              "Resource": "*",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": Object {
+          "Fn::Join": Array [
+            "-",
+            Array [
+              Object {
+                "Ref": "UserPool",
+              },
+              "hostedUIProvider",
+            ],
+          ],
+        },
+        "Roles": Array [
+          Object {
+            "Ref": "UserPoolClientRole",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "IdentityPool": Object {
+      "DependsOn": Array [
+        "UserPoolClientInputs",
+      ],
+      "Properties": Object {
+        "AllowUnauthenticatedIdentities": Object {
+          "Ref": "allowUnauthenticatedIdentities",
+        },
+        "CognitoIdentityProviders": Array [
+          Object {
+            "ClientId": Object {
+              "Ref": "UserPoolClient",
+            },
+            "ProviderName": Object {
+              "Fn::Sub": Array [
+                "cognito-idp.\${region}.amazonaws.com/\${client}",
+                Object {
+                  "client": Object {
+                    "Ref": "UserPool",
+                  },
+                  "region": Object {
+                    "Ref": "AWS::Region",
+                  },
+                },
+              ],
+            },
+          },
+          Object {
+            "ClientId": Object {
+              "Ref": "UserPoolClientWeb",
+            },
+            "ProviderName": Object {
+              "Fn::Sub": Array [
+                "cognito-idp.\${region}.amazonaws.com/\${client}",
+                Object {
+                  "client": Object {
+                    "Ref": "UserPool",
+                  },
+                  "region": Object {
+                    "Ref": "AWS::Region",
+                  },
+                },
+              ],
+            },
+          },
+        ],
+        "IdentityPoolName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            "extauth387063394_identitypool_87063394",
+            Object {
+              "Fn::Join": Array [
+                "",
+                Array [
+                  "extauth387063394_identitypool_87063394-",
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+        "SupportedLoginProviders": Object {
+          "accounts.google.com": Object {
+            "Ref": "googleClientId",
+          },
+          "appleid.apple.com": Object {
+            "Ref": "appleAppId",
+          },
+          "graph.facebook.com": Object {
+            "Ref": "facebookAppId",
+          },
+          "www.amazon.com": Object {
+            "Ref": "amazonAppId",
+          },
+        },
+      },
+      "Type": "AWS::Cognito::IdentityPool",
+    },
+    "IdentityPoolRoleMap": Object {
+      "DependsOn": Array [
+        "IdentityPool",
+      ],
+      "Properties": Object {
+        "IdentityPoolId": Object {
+          "Ref": "IdentityPool",
+        },
+        "Roles": Object {
+          "authenticated": Object {
+            "Ref": "authRoleArn",
+          },
+          "unauthenticated": Object {
+            "Ref": "unauthRoleArn",
+          },
+        },
+      },
+      "Type": "AWS::Cognito::IdentityPoolRoleAttachment",
+    },
+    "MFALambda": Object {
+      "DependsOn": Array [
+        "MFALambdaRole",
+      ],
+      "Properties": Object {
+        "Code": Object {
+          "ZipFile": "const response = require('cfn-response');
+const aws = require('aws-sdk');
+const identity = new aws.CognitoIdentityServiceProvider();
+exports.handler = (event, context, callback) => {
+  if (event.RequestType == 'Delete') {
+    response.send(event, context, response.SUCCESS, {});
+  }
+  if (event.RequestType == 'Update' || event.RequestType == 'Create') {
+    let totpParams = {};
+    try {
+      totpParams = {
+        UserPoolId: event.ResourceProperties.userPoolId,
+        MfaConfiguration: event.ResourceProperties.mfaConfiguration,
+        SmsMfaConfiguration: {
+          SmsAuthenticationMessage: event.ResourceProperties.smsAuthenticationMessage,
+          SmsConfiguration: {
+            SnsCallerArn: event.ResourceProperties.smsConfigCaller,
+            ExternalId: event.ResourceProperties.smsConfigExternalId,
+          },
+        },
+        SoftwareTokenMfaConfiguration: { Enabled: event.ResourceProperties.totpEnabled.toLowerCase() === true ? true : false },
+      };
+      console.log(totpParams);
+    } catch (e) {
+      response.send(event, context, response.FAILED, { e });
+    }
+    identity
+      .setUserPoolMfaConfig(totpParams)
+      .promise()
+      .then(res => {
+        response.send(event, context, response.SUCCESS, { res });
+      })
+      .catch(err => {
+        response.send(event, context, response.FAILED, { err });
+      });
+  }
+};
+",
+        },
+        "Handler": "index.handler",
+        "Role": Object {
+          "Fn::GetAtt": Array [
+            "MFALambdaRole",
+            "Arn",
+          ],
+        },
+        "Runtime": "nodejs12.x",
+        "Timeout": 300,
+      },
+      "Type": "AWS::Lambda::Function",
+    },
+    "MFALambdaInputs": Object {
+      "DeletionPolicy": "Delete",
+      "DependsOn": Array [
+        "MFALogPolicy",
+      ],
+      "Properties": Object {
+        "ServiceToken": Object {
+          "Fn::GetAtt": Array [
+            "MFALambda",
+            "Arn",
+          ],
+        },
+        "mfaConfiguration": Object {
+          "Ref": "mfaConfiguration",
+        },
+        "smsAuthenticationMessage": Object {
+          "Ref": "smsAuthenticationMessage",
+        },
+        "smsConfigCaller": Object {
+          "Fn::GetAtt": Array [
+            "SNSRole",
+            "Arn",
+          ],
+        },
+        "smsConfigExternalId": "extaut87063394_role_external_id",
+        "totpEnabled": true,
+        "userPoolId": Object {
+          "Ref": "UserPool",
+        },
+      },
+      "Type": "Custom::LambdaCallout",
+      "UpdateReplacePolicy": "Delete",
+    },
+    "MFALambdaPolicy": Object {
+      "DependsOn": Array [
+        "MFALambda",
+      ],
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "cognito-idp:SetUserPoolMfaConfig",
+              ],
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::GetAtt": Array [
+                  "UserPool",
+                  "Arn",
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": "extaut87063394_totp_lambda_iam_policy",
+        "Roles": Array [
+          Object {
+            "Fn::If": Array [
+              "ShouldNotCreateEnvResources",
+              "extaut87063394_totp_lambda_role",
+              Object {
+                "Fn::Join": Array [
+                  "",
+                  Array [
+                    "extaut87063394_totp_lambda_role-",
+                    Object {
+                      "Ref": "env",
+                    },
+                  ],
+                ],
+              },
+            ],
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "MFALambdaRole": Object {
+      "DependsOn": Array [
+        "SNSRole",
+      ],
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": Object {
+                "Service": "lambda.amazonaws.com",
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "Policies": Array [
+          Object {
+            "PolicyDocument": Object {
+              "Statement": Array [
+                Object {
+                  "Action": Array [
+                    "iam:PassRole",
+                  ],
+                  "Effect": "Allow",
+                  "Resource": Object {
+                    "Fn::If": Array [
+                      "ShouldNotCreateEnvResources",
+                      "arn:aws:iam:::role/extaut87063394_totp_lambda_role",
+                      Object {
+                        "Fn::Join": Array [
+                          "",
+                          Array [
+                            "arn:aws:iam:::role/extaut87063394__totp_lambda_role-",
+                            Object {
+                              "Ref": "env",
+                            },
+                          ],
+                        ],
+                      },
+                    ],
+                  },
+                },
+              ],
+              "Version": "2012-10-17",
+            },
+            "PolicyName": "extaut87063394_totp_pass_role_policy",
+          },
+          Object {
+            "PolicyDocument": Object {
+              "Statement": Array [
+                Object {
+                  "Action": Array [
+                    "iam:PassRole",
+                  ],
+                  "Effect": "Allow",
+                  "Resource": Object {
+                    "Fn::GetAtt": Array [
+                      "SNSRole",
+                      "Arn",
+                    ],
+                  },
+                },
+              ],
+              "Version": "2012-10-17",
+            },
+            "PolicyName": "extaut87063394_sns_pass_role_policy",
+          },
+        ],
+        "RoleName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            "extaut87063394_totp_lambda_role",
+            Object {
+              "Fn::Join": Array [
+                "",
+                Array [
+                  "extaut87063394_totp_lambda_role-",
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+    "MFALogPolicy": Object {
+      "DependsOn": Array [
+        "MFALambdaPolicy",
+      ],
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "logs:CreateLogGroup",
+                "logs:CreateLogStream",
+                "logs:PutLogEvents",
+              ],
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::Sub": Array [
+                  "arn:aws:logs:\${region}:\${account}:log-group:/aws/lambda/\${lambda}:log-stream:*",
+                  Object {
+                    "account": Object {
+                      "Ref": "AWS::AccountId",
+                    },
+                    "lambda": Object {
+                      "Ref": "MFALambda",
+                    },
+                    "region": Object {
+                      "Ref": "AWS::Region",
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": "extaut87063394_totp_lambda_log_policy",
+        "Roles": Array [
+          Object {
+            "Fn::If": Array [
+              "ShouldNotCreateEnvResources",
+              "extaut87063394_totp_lambda_role",
+              Object {
+                "Fn::Join": Array [
+                  "",
+                  Array [
+                    "extaut87063394_totp_lambda_role-",
+                    Object {
+                      "Ref": "env",
+                    },
+                  ],
+                ],
+              },
+            ],
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "OAuthCustomResource": Object {
+      "DependsOn": Array [
+        "HostedUICustomResourceInputs",
+      ],
+      "Properties": Object {
+        "Code": Object {
+          "ZipFile": "const response = require('cfn-response');
+const aws = require('aws-sdk');
+const identity = new aws.CognitoIdentityServiceProvider();
+exports.handler = (event, context, callback) => {
+  try {
+    const userPoolId = event.ResourceProperties.userPoolId;
+    let webClientId = event.ResourceProperties.webClientId;
+    let nativeClientId = event.ResourceProperties.nativeClientId;
+    let hostedUIProviderMeta = JSON.parse(event.ResourceProperties.hostedUIProviderMeta);
+    let oAuthMetadata = JSON.parse(event.ResourceProperties.oAuthMetadata);
+    let providerList = hostedUIProviderMeta.map(provider => provider.ProviderName);
+    providerList.push('COGNITO');
+    if (event.RequestType == 'Delete') {
+      response.send(event, context, response.SUCCESS, {});
+    }
+    if (event.RequestType == 'Update' || event.RequestType == 'Create') {
+      let params = {
+        UserPoolId: userPoolId,
+        AllowedOAuthFlows: oAuthMetadata.AllowedOAuthFlows,
+        AllowedOAuthFlowsUserPoolClient: true,
+        AllowedOAuthScopes: oAuthMetadata.AllowedOAuthScopes,
+        CallbackURLs: oAuthMetadata.CallbackURLs,
+        LogoutURLs: oAuthMetadata.LogoutURLs,
+        SupportedIdentityProviders: providerList,
+      };
+      console.log(params);
+      let updateUserPoolClientPromises = [];
+      params.ClientId = webClientId;
+      updateUserPoolClientPromises.push(identity.updateUserPoolClient(params).promise());
+      params.ClientId = nativeClientId;
+      updateUserPoolClientPromises.push(identity.updateUserPoolClient(params).promise());
+      Promise.all(updateUserPoolClientPromises)
+        .then(() => {
+          response.send(event, context, response.SUCCESS, {});
+        })
+        .catch(err => {
+          console.log(err.stack);
+          response.send(event, context, response.FAILED, { err });
+        });
+    }
+  } catch (err) {
+    console.log(err.stack);
+    response.send(event, context, response.FAILED, { err });
+  }
+};
+",
+        },
+        "Handler": "index.handler",
+        "Role": Object {
+          "Fn::GetAtt": Array [
+            "UserPoolClientRole",
+            "Arn",
+          ],
+        },
+        "Runtime": "nodejs12.x",
+        "Timeout": 300,
+      },
+      "Type": "AWS::Lambda::Function",
+    },
+    "OAuthCustomResourceInputs": Object {
+      "DeletionPolicy": "Delete",
+      "DependsOn": Array [
+        "OAuthCustomResourceLogPolicy",
+      ],
+      "Properties": Object {
+        "ServiceToken": Object {
+          "Fn::GetAtt": Array [
+            "OAuthCustomResource",
+            "Arn",
+          ],
+        },
+        "hostedUIProviderMeta": Object {
+          "Ref": "hostedUIProviderMeta",
+        },
+        "nativeClientId": Object {
+          "Ref": "UserPoolClient",
+        },
+        "oAuthMetadata": Object {
+          "Ref": "oAuthMetadata",
+        },
+        "userPoolId": Object {
+          "Ref": "UserPool",
+        },
+        "webClientId": Object {
+          "Ref": "UserPoolClientWeb",
+        },
+      },
+      "Type": "Custom::LambdaCallout",
+      "UpdateReplacePolicy": "Delete",
+    },
+    "OAuthCustomResourceLogPolicy": Object {
+      "DependsOn": Array [
+        "OAuthCustomResourcePolicy",
+      ],
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "logs:CreateLogGroup",
+                "logs:CreateLogStream",
+                "logs:PutLogEvents",
+              ],
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::Sub": Array [
+                  "arn:aws:logs:\${region}:\${account}:log-group:/aws/lambda/\${lambda}:log-stream:*",
+                  Object {
+                    "account": Object {
+                      "Ref": "AWS::AccountId",
+                    },
+                    "lambda": Object {
+                      "Ref": "OAuthCustomResource",
+                    },
+                    "region": Object {
+                      "Ref": "AWS::Region",
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": Object {
+          "Fn::Join": Array [
+            "-",
+            Array [
+              Object {
+                "Ref": "UserPool",
+              },
+              "OAuthLogPolicy",
+            ],
+          ],
+        },
+        "Roles": Array [
+          Object {
+            "Ref": "UserPoolClientRole",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "OAuthCustomResourcePolicy": Object {
+      "DependsOn": Array [
+        "OAuthCustomResource",
+      ],
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "cognito-idp:UpdateUserPoolClient",
+              ],
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::GetAtt": Array [
+                  "UserPool",
+                  "Arn",
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": Object {
+          "Fn::Join": Array [
+            "-",
+            Array [
+              Object {
+                "Ref": "UserPool",
+              },
+              "OAuth",
+            ],
+          ],
+        },
+        "Roles": Array [
+          Object {
+            "Ref": "UserPoolClientRole",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "SNSRole": Object {
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "sts:AssumeRole",
+              ],
+              "Condition": Object {
+                "StringEquals": Object {
+                  "sts:ExternalId": "extaut87063394_role_external_id",
+                },
+              },
+              "Effect": "Allow",
+              "Principal": Object {
+                "Service": "cognito-idp.amazonaws.com",
+              },
+              "Sid": "",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "Policies": Array [
+          Object {
+            "PolicyDocument": Object {
+              "Statement": Array [
+                Object {
+                  "Action": Array [
+                    "sns:Publish",
+                  ],
+                  "Effect": "Allow",
+                  "Resource": "*",
+                },
+              ],
+              "Version": "2012-10-17",
+            },
+            "PolicyName": "extaut87063394-sns-policy",
+          },
+        ],
+        "RoleName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            "extaut87063394_sns-role",
+            Object {
+              "Fn::Join": Array [
+                "",
+                Array [
+                  "sns87063394",
+                  Object {
+                    "Fn::Select": Array [
+                      3,
+                      Object {
+                        "Fn::Split": Array [
+                          "-",
+                          Object {
+                            "Ref": "AWS::StackName",
+                          },
+                        ],
+                      },
+                    ],
+                  },
+                  "-",
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+    "UserPool": Object {
+      "DeletionPolicy": "Retain",
+      "DependsOn": Array [
+        "SNSRole",
+      ],
+      "Properties": Object {
+        "AutoVerifiedAttributes": Array [
+          "email",
+        ],
+        "EmailVerificationMessage": Object {
+          "Ref": "emailVerificationMessage",
+        },
+        "EmailVerificationSubject": Object {
+          "Ref": "emailVerificationSubject",
+        },
+        "MfaConfiguration": Object {
+          "Ref": "mfaConfiguration",
+        },
+        "Policies": Object {
+          "PasswordPolicy": Object {
+            "MinimumLength": Object {
+              "Ref": "passwordPolicyMinLength",
+            },
+            "RequireLowercase": true,
+            "RequireNumbers": true,
+            "RequireSymbols": true,
+            "RequireUppercase": true,
+          },
+        },
+        "Schema": Array [
+          Object {
+            "Mutable": true,
+            "Name": "email",
+            "Required": true,
+          },
+        ],
+        "SmsAuthenticationMessage": Object {
+          "Ref": "smsAuthenticationMessage",
+        },
+        "SmsConfiguration": Object {
+          "ExternalId": "extaut87063394_role_external_id",
+          "SnsCallerArn": Object {
+            "Fn::GetAtt": Array [
+              "SNSRole",
+              "Arn",
+            ],
+          },
+        },
+        "SmsVerificationMessage": Object {
+          "Ref": "smsVerificationMessage",
+        },
+        "UserPoolName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            Object {
+              "Ref": "userPoolName",
+            },
+            Object {
+              "Fn::Join": Array [
+                "",
+                Array [
+                  Object {
+                    "Ref": "userPoolName",
+                  },
+                  "-",
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+        "UsernameConfiguration": Object {
+          "CaseSensitive": false,
+        },
+      },
+      "Type": "AWS::Cognito::UserPool",
+      "UpdateReplacePolicy": "Retain",
+    },
+    "UserPoolClient": Object {
+      "DependsOn": Array [
+        "UserPool",
+      ],
+      "Properties": Object {
+        "ClientName": "extaut87063394_app_client",
+        "GenerateSecret": Object {
+          "Ref": "userpoolClientGenerateSecret",
+        },
+        "ReadAttributes": Object {
+          "Ref": "userpoolClientReadAttributes",
+        },
+        "RefreshTokenValidity": Object {
+          "Ref": "userpoolClientRefreshTokenValidity",
+        },
+        "UserPoolId": Object {
+          "Ref": "UserPool",
+        },
+        "WriteAttributes": Object {
+          "Ref": "userpoolClientWriteAttributes",
+        },
+      },
+      "Type": "AWS::Cognito::UserPoolClient",
+    },
+    "UserPoolClientInputs": Object {
+      "DeletionPolicy": "Delete",
+      "DependsOn": Array [
+        "UserPoolClientLogPolicy",
+      ],
+      "Properties": Object {
+        "ServiceToken": Object {
+          "Fn::GetAtt": Array [
+            "UserPoolClientLambda",
+            "Arn",
+          ],
+        },
+        "clientId": Object {
+          "Ref": "UserPoolClient",
+        },
+        "userpoolId": Object {
+          "Ref": "UserPool",
+        },
+      },
+      "Type": "Custom::LambdaCallout",
+      "UpdateReplacePolicy": "Delete",
+    },
+    "UserPoolClientLambda": Object {
+      "DependsOn": Array [
+        "UserPoolClientRole",
+      ],
+      "Properties": Object {
+        "Code": Object {
+          "ZipFile": "const response = require('cfn-response');
+const aws = require('aws-sdk');
+const identity = new aws.CognitoIdentityServiceProvider();
+exports.handler = (event, context, callback) => {
+  if (event.RequestType == 'Delete') {
+    response.send(event, context, response.SUCCESS, {});
+  }
+  if (event.RequestType == 'Update' || event.RequestType == 'Create') {
+    const params = {
+      ClientId: event.ResourceProperties.clientId,
+      UserPoolId: event.ResourceProperties.userpoolId,
+    };
+    identity
+      .describeUserPoolClient(params)
+      .promise()
+      .then(res => {
+        response.send(event, context, response.SUCCESS, { appSecret: res.UserPoolClient.ClientSecret });
+      })
+      .catch(err => {
+        response.send(event, context, response.FAILED, { err });
+      });
+  }
+};
+",
+        },
+        "Handler": "index.handler",
+        "Role": Object {
+          "Fn::GetAtt": Array [
+            "UserPoolClientRole",
+            "Arn",
+          ],
+        },
+        "Runtime": "nodejs12.x",
+        "Timeout": 300,
+      },
+      "Type": "AWS::Lambda::Function",
+    },
+    "UserPoolClientLambdaPolicy": Object {
+      "DependsOn": Array [
+        "UserPoolClientLambda",
+      ],
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "cognito-idp:DescribeUserPoolClient",
+              ],
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::GetAtt": Array [
+                  "UserPool",
+                  "Arn",
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": "extaut87063394_userpoolclient_lambda_iam_policy",
+        "Roles": Array [
+          Object {
+            "Ref": "UserPoolClientRole",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "UserPoolClientLogPolicy": Object {
+      "DependsOn": Array [
+        "UserPoolClientLambdaPolicy",
+      ],
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "logs:CreateLogGroup",
+                "logs:CreateLogStream",
+                "logs:PutLogEvents",
+              ],
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::Sub": Array [
+                  "arn:aws:logs:\${region}:\${account}:log-group:/aws/lambda/\${lambda}:log-stream:*",
+                  Object {
+                    "account": Object {
+                      "Ref": "AWS::AccountId",
+                    },
+                    "lambda": Object {
+                      "Ref": "UserPoolClientLambda",
+                    },
+                    "region": Object {
+                      "Ref": "AWS::Region",
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": "extaut87063394_userpoolclient_lambda_log_policy",
+        "Roles": Array [
+          Object {
+            "Ref": "UserPoolClientRole",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "UserPoolClientRole": Object {
+      "DependsOn": Array [
+        "UserPoolClient",
+      ],
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": Object {
+                "Service": "lambda.amazonaws.com",
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "RoleName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            Object {
+              "Ref": "userpoolClientLambdaRole",
+            },
+            Object {
+              "Fn::Join": Array [
+                "",
+                Array [
+                  "upClientLambdaRole87063394",
+                  Object {
+                    "Fn::Select": Array [
+                      3,
+                      Object {
+                        "Fn::Split": Array [
+                          "-",
+                          Object {
+                            "Ref": "AWS::StackName",
+                          },
+                        ],
+                      },
+                    ],
+                  },
+                  "-",
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+    "UserPoolClientWeb": Object {
+      "DependsOn": Array [
+        "UserPool",
+      ],
+      "Properties": Object {
+        "ClientName": "extaut87063394_app_clientWeb",
+        "ReadAttributes": Object {
+          "Ref": "userpoolClientReadAttributes",
+        },
+        "RefreshTokenValidity": Object {
+          "Ref": "userpoolClientRefreshTokenValidity",
+        },
+        "UserPoolId": Object {
+          "Ref": "UserPool",
+        },
+        "WriteAttributes": Object {
+          "Ref": "userpoolClientWriteAttributes",
+        },
+      },
+      "Type": "AWS::Cognito::UserPoolClient",
+    },
+  },
+}
+`;
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/__snapshots__/user-pool-group-stack-transform.test.ts.snap b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/__snapshots__/user-pool-group-stack-transform.test.ts.snap
new file mode 100644
index 00000000000..389eac51d50
--- /dev/null
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/__snapshots__/user-pool-group-stack-transform.test.ts.snap
@@ -0,0 +1,591 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Check UserPool Group Template Generated rootstack template during Push one group 1`] = `
+Object {
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Conditions": Object {
+    "ShouldNotCreateEnvResources": Object {
+      "Fn::Equals": Array [
+        Object {
+          "Ref": "env",
+        },
+        "NONE",
+      ],
+    },
+  },
+  "Description": "Root Stack for AWS Amplify CLI",
+  "Outputs": Object {
+    "adinGroupRole": Object {
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "adinGroupRole",
+          "Arn",
+        ],
+      },
+    },
+  },
+  "Parameters": Object {
+    "AuthRoleArn": Object {
+      "Type": "String",
+    },
+    "UnauthRoleArn": Object {
+      "Type": "String",
+    },
+    "authmockResourceAppClientID": Object {
+      "Type": "String",
+    },
+    "authmockResourceAppClientIDWeb": Object {
+      "Type": "String",
+    },
+    "authmockResourceIdentityPoolId": Object {
+      "Type": "String",
+    },
+    "authmockResourceUserPoolId": Object {
+      "Type": "String",
+    },
+    "env": Object {
+      "Type": "String",
+    },
+  },
+  "Resources": Object {
+    "LambdaExecutionRole": Object {
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "sts:AssumeRole",
+              ],
+              "Effect": "Allow",
+              "Principal": Object {
+                "Service": Array [
+                  "lambda.amazonaws.com",
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "Policies": Array [
+          Object {
+            "PolicyDocument": Object {
+              "Statement": Array [
+                Object {
+                  "Action": Array [
+                    "logs:CreateLogGroup",
+                    "logs:CreateLogStream",
+                    "logs:PutLogEvents",
+                  ],
+                  "Effect": "Allow",
+                  "Resource": "arn:aws:logs:*:*:*",
+                },
+              ],
+              "Version": "2012-10-17",
+            },
+            "PolicyName": "UserGroupLogPolicy",
+          },
+          Object {
+            "PolicyDocument": Object {
+              "Statement": Array [
+                Object {
+                  "Action": Array [
+                    "cognito-identity:SetIdentityPoolRoles",
+                    "cognito-identity:ListIdentityPools",
+                    "cognito-identity:describeIdentityPool",
+                  ],
+                  "Effect": "Allow",
+                  "Resource": "*",
+                },
+              ],
+              "Version": "2012-10-17",
+            },
+            "PolicyName": "UserGroupExecutionPolicy",
+          },
+          Object {
+            "PolicyDocument": Object {
+              "Statement": Array [
+                Object {
+                  "Action": Array [
+                    "iam:PassRole",
+                  ],
+                  "Effect": "Allow",
+                  "Resource": Array [
+                    Object {
+                      "Ref": "AuthRoleArn",
+                    },
+                    Object {
+                      "Ref": "UnauthRoleArn",
+                    },
+                  ],
+                },
+              ],
+              "Version": "2012-10-17",
+            },
+            "PolicyName": "UserGroupPassRolePolicy",
+          },
+        ],
+        "RoleName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            "mockResource",
+            Object {
+              "Fn::Join": Array [
+                "",
+                Array [
+                  "mockResource-ExecutionRole",
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+    "RoleMapFunctionInput": Object {
+      "DeletionPolicy": "Delete",
+      "Properties": Object {
+        "AuthRoleArn": Object {
+          "Ref": "AuthRoleArn",
+        },
+        "ServiceToken": Object {
+          "Fn::GetAtt": Array [
+            "RoleMapLambdaFunction",
+            "Arn",
+          ],
+        },
+        "UnauthRoleArn": Object {
+          "Ref": "UnauthRoleArn",
+        },
+        "appClientID": Object {
+          "Ref": "authmockResourceAppClientID",
+        },
+        "appClientIDWeb": Object {
+          "Ref": "authmockResourceAppClientIDWeb",
+        },
+        "env": Object {
+          "Ref": "env",
+        },
+        "identityPoolId": Object {
+          "Ref": "authmockResourceIdentityPoolId",
+        },
+        "region": Object {
+          "Ref": "AWS::Region",
+        },
+        "userPoolId": Object {
+          "Ref": "authmockResourceUserPoolId",
+        },
+      },
+      "Type": "Custom::LambdaCallout",
+      "UpdateReplacePolicy": "Delete",
+    },
+    "RoleMapLambdaFunction": Object {
+      "Properties": Object {
+        "Code": Object {
+          "ZipFile": "const response = require('cfn-response');
+const AWS = require('aws-sdk');
+exports.handler = (event, context) => {
+  if (event.RequestType == 'Delete') {
+    response.send(event, context, response.SUCCESS, { message: 'Request type delete' });
+  }
+  if (event.RequestType == 'Create' || event.RequestType == 'Update') {
+    let { identityPoolId, appClientID, appClientIDWeb, userPoolId, region } = event.ResourceProperties;
+    try {
+      const cognitoidentity = new AWS.CognitoIdentity();
+      let params = {
+        IdentityPoolId: identityPoolId,
+        Roles: {
+          authenticated: event.ResourceProperties.AuthRoleArn,
+          unauthenticated: event.ResourceProperties.UnauthRoleArn,
+        },
+        RoleMappings: {},
+      };
+      if (appClientIDWeb) {
+        params.RoleMappings[\`cognito-idp.\${region}.amazonaws.com/\${userPoolId}:\${appClientIDWeb}\`] = {
+          Type: 'Token',
+          AmbiguousRoleResolution: 'AuthenticatedRole',
+        };
+      }
+      if (appClientID) {
+        params.RoleMappings[\`cognito-idp.\${region}.amazonaws.com/\${userPoolId}:\${appClientID}\`] = {
+          Type: 'Token',
+          AmbiguousRoleResolution: 'AuthenticatedRole',
+        };
+      }
+      cognitoidentity.setIdentityPoolRoles(params).promise();
+      response.send(event, context, response.SUCCESS, { message: 'Successfully updated identity pool.' });
+    } catch (err) {
+      response.send(event, context, response.FAILED, { message: 'Error updating identity pool' });
+    }
+  }
+};
+",
+        },
+        "Handler": "index.handler",
+        "Role": Object {
+          "Fn::GetAtt": Array [
+            "LambdaExecutionRole",
+            "Arn",
+          ],
+        },
+        "Runtime": "nodejs12.x",
+        "Timeout": 300,
+      },
+      "Type": "AWS::Lambda::Function",
+    },
+    "adinGroup": Object {
+      "Properties": Object {
+        "Description": "override success",
+        "GroupName": "adin",
+        "Precedence": 1,
+        "RoleArn": Object {
+          "Fn::GetAtt": Array [
+            "adinGroupRole",
+            "Arn",
+          ],
+        },
+        "UserPoolId": Object {
+          "Ref": "authmockResourceUserPoolId",
+        },
+      },
+      "Type": "AWS::Cognito::UserPoolGroup",
+    },
+    "adinGroupRole": Object {
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": "sts:AssumeRoleWithWebIdentity",
+              "Condition": Object {
+                "ForAnyValue:StringLike": Object {
+                  "cognito-identity.amazonaws.com:amr": "authenticated",
+                },
+                "StringEquals": Object {
+                  "cognito-identity.amazonaws.com:aud": Object {
+                    "Ref": "authmockResourceIdentityPoolId",
+                  },
+                },
+              },
+              "Effect": "Allow",
+              "Principal": Object {
+                "Federated": "cognito-identity.amazonaws.com",
+              },
+              "Sid": "",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "RoleName": Object {
+          "Fn::Join": Array [
+            "",
+            Array [
+              Object {
+                "Ref": "authmockResourceUserPoolId",
+              },
+              "adinGroupRole",
+            ],
+          ],
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+  },
+}
+`;
+
+exports[`Check UserPool Group Template Generated rootstack template during Push with two groups 1`] = `
+Object {
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Conditions": Object {
+    "ShouldNotCreateEnvResources": Object {
+      "Fn::Equals": Array [
+        Object {
+          "Ref": "env",
+        },
+        "NONE",
+      ],
+    },
+  },
+  "Description": "Root Stack for AWS Amplify CLI",
+  "Outputs": Object {
+    "adinmockGroupRole": Object {
+      "Value": Object {
+        "Fn::GetAtt": Array [
+          "adinmockGroupRole",
+          "Arn",
+        ],
+      },
+    },
+  },
+  "Parameters": Object {
+    "AuthRoleArn": Object {
+      "Type": "String",
+    },
+    "UnauthRoleArn": Object {
+      "Type": "String",
+    },
+    "authmockResourceAppClientID": Object {
+      "Type": "String",
+    },
+    "authmockResourceAppClientIDWeb": Object {
+      "Type": "String",
+    },
+    "authmockResourceIdentityPoolId": Object {
+      "Type": "String",
+    },
+    "authmockResourceUserPoolId": Object {
+      "Type": "String",
+    },
+    "env": Object {
+      "Type": "String",
+    },
+  },
+  "Resources": Object {
+    "LambdaExecutionRole": Object {
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": Array [
+                "sts:AssumeRole",
+              ],
+              "Effect": "Allow",
+              "Principal": Object {
+                "Service": Array [
+                  "lambda.amazonaws.com",
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "Policies": Array [
+          Object {
+            "PolicyDocument": Object {
+              "Statement": Array [
+                Object {
+                  "Action": Array [
+                    "logs:CreateLogGroup",
+                    "logs:CreateLogStream",
+                    "logs:PutLogEvents",
+                  ],
+                  "Effect": "Allow",
+                  "Resource": "arn:aws:logs:*:*:*",
+                },
+              ],
+              "Version": "2012-10-17",
+            },
+            "PolicyName": "UserGroupLogPolicy",
+          },
+          Object {
+            "PolicyDocument": Object {
+              "Statement": Array [
+                Object {
+                  "Action": Array [
+                    "cognito-identity:SetIdentityPoolRoles",
+                    "cognito-identity:ListIdentityPools",
+                    "cognito-identity:describeIdentityPool",
+                  ],
+                  "Effect": "Allow",
+                  "Resource": "*",
+                },
+              ],
+              "Version": "2012-10-17",
+            },
+            "PolicyName": "UserGroupExecutionPolicy",
+          },
+          Object {
+            "PolicyDocument": Object {
+              "Statement": Array [
+                Object {
+                  "Action": Array [
+                    "iam:PassRole",
+                  ],
+                  "Effect": "Allow",
+                  "Resource": Array [
+                    Object {
+                      "Ref": "AuthRoleArn",
+                    },
+                    Object {
+                      "Ref": "UnauthRoleArn",
+                    },
+                  ],
+                },
+              ],
+              "Version": "2012-10-17",
+            },
+            "PolicyName": "UserGroupPassRolePolicy",
+          },
+        ],
+        "RoleName": Object {
+          "Fn::If": Array [
+            "ShouldNotCreateEnvResources",
+            "mockResource",
+            Object {
+              "Fn::Join": Array [
+                "",
+                Array [
+                  "mockResource-ExecutionRole",
+                  Object {
+                    "Ref": "env",
+                  },
+                ],
+              ],
+            },
+          ],
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+    "RoleMapFunctionInput": Object {
+      "DeletionPolicy": "Delete",
+      "Properties": Object {
+        "AuthRoleArn": Object {
+          "Ref": "AuthRoleArn",
+        },
+        "ServiceToken": Object {
+          "Fn::GetAtt": Array [
+            "RoleMapLambdaFunction",
+            "Arn",
+          ],
+        },
+        "UnauthRoleArn": Object {
+          "Ref": "UnauthRoleArn",
+        },
+        "appClientID": Object {
+          "Ref": "authmockResourceAppClientID",
+        },
+        "appClientIDWeb": Object {
+          "Ref": "authmockResourceAppClientIDWeb",
+        },
+        "env": Object {
+          "Ref": "env",
+        },
+        "identityPoolId": Object {
+          "Ref": "authmockResourceIdentityPoolId",
+        },
+        "region": Object {
+          "Ref": "AWS::Region",
+        },
+        "userPoolId": Object {
+          "Ref": "authmockResourceUserPoolId",
+        },
+      },
+      "Type": "Custom::LambdaCallout",
+      "UpdateReplacePolicy": "Delete",
+    },
+    "RoleMapLambdaFunction": Object {
+      "Properties": Object {
+        "Code": Object {
+          "ZipFile": "const response = require('cfn-response');
+const AWS = require('aws-sdk');
+exports.handler = (event, context) => {
+  if (event.RequestType == 'Delete') {
+    response.send(event, context, response.SUCCESS, { message: 'Request type delete' });
+  }
+  if (event.RequestType == 'Create' || event.RequestType == 'Update') {
+    let { identityPoolId, appClientID, appClientIDWeb, userPoolId, region } = event.ResourceProperties;
+    try {
+      const cognitoidentity = new AWS.CognitoIdentity();
+      let params = {
+        IdentityPoolId: identityPoolId,
+        Roles: {
+          authenticated: event.ResourceProperties.AuthRoleArn,
+          unauthenticated: event.ResourceProperties.UnauthRoleArn,
+        },
+        RoleMappings: {},
+      };
+      if (appClientIDWeb) {
+        params.RoleMappings[\`cognito-idp.\${region}.amazonaws.com/\${userPoolId}:\${appClientIDWeb}\`] = {
+          Type: 'Token',
+          AmbiguousRoleResolution: 'AuthenticatedRole',
+        };
+      }
+      if (appClientID) {
+        params.RoleMappings[\`cognito-idp.\${region}.amazonaws.com/\${userPoolId}:\${appClientID}\`] = {
+          Type: 'Token',
+          AmbiguousRoleResolution: 'AuthenticatedRole',
+        };
+      }
+      cognitoidentity.setIdentityPoolRoles(params).promise();
+      response.send(event, context, response.SUCCESS, { message: 'Successfully updated identity pool.' });
+    } catch (err) {
+      response.send(event, context, response.FAILED, { message: 'Error updating identity pool' });
+    }
+  }
+};
+",
+        },
+        "Handler": "index.handler",
+        "Role": Object {
+          "Fn::GetAtt": Array [
+            "LambdaExecutionRole",
+            "Arn",
+          ],
+        },
+        "Runtime": "nodejs12.x",
+        "Timeout": 300,
+      },
+      "Type": "AWS::Lambda::Function",
+    },
+    "adinmockGroup": Object {
+      "Properties": Object {
+        "Description": "override success",
+        "GroupName": "adinmock",
+        "Precedence": 2,
+        "RoleArn": Object {
+          "Fn::GetAtt": Array [
+            "adinmockGroupRole",
+            "Arn",
+          ],
+        },
+        "UserPoolId": Object {
+          "Ref": "authmockResourceUserPoolId",
+        },
+      },
+      "Type": "AWS::Cognito::UserPoolGroup",
+    },
+    "adinmockGroupRole": Object {
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": "sts:AssumeRoleWithWebIdentity",
+              "Condition": Object {
+                "ForAnyValue:StringLike": Object {
+                  "cognito-identity.amazonaws.com:amr": "authenticated",
+                },
+                "StringEquals": Object {
+                  "cognito-identity.amazonaws.com:aud": Object {
+                    "Ref": "authmockResourceIdentityPoolId",
+                  },
+                },
+              },
+              "Effect": "Allow",
+              "Principal": Object {
+                "Federated": "cognito-identity.amazonaws.com",
+              },
+              "Sid": "",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "RoleName": Object {
+          "Fn::Join": Array [
+            "",
+            Array [
+              Object {
+                "Ref": "authmockResourceUserPoolId",
+              },
+              "adinmockGroupRole",
+            ],
+          ],
+        },
+      },
+      "Type": "AWS::IAM::Role",
+    },
+  },
+}
+`;
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/auth-stack-transform.test.ts b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/auth-stack-transform.test.ts
new file mode 100644
index 00000000000..11a2f0fc49d
--- /dev/null
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/auth-stack-transform.test.ts
@@ -0,0 +1,188 @@
+import { AmplifyAuthTransform } from '../../../../provider-utils/awscloudformation/auth-stack-builder';
+import { $TSContext } from 'amplify-cli-core';
+
+jest.mock('amplify-cli-core', () => ({
+  ...(jest.requireActual('amplify-cli-core') as {}),
+  stateManager: {
+    getLocalEnvInfo: jest.fn().mockReturnValue('testenv'),
+    getMeta: jest.fn().mockReturnValue({
+      auth: {
+        resource1: {},
+      },
+    }),
+  },
+  pathManager: {
+    getBackendDirPath: jest.fn().mockReturnValue(__dirname),
+  },
+  JSONUtilities: {
+    writeJson: jest.fn(),
+    readJson: jest.fn(),
+  },
+  FeatureFlags: {
+    getBoolean: jest.fn().mockReturnValue(true),
+  },
+  buildOverrideDir: jest.fn().mockResolvedValue(false),
+  writeCFNTemplate: jest.fn(),
+}));
+
+const getCLIInputPayload_mock = jest
+  .fn()
+  .mockReturnValueOnce({
+    cognitoConfig: {
+      identityPoolName: 'extauth387063394_identitypool_87063394',
+      allowUnauthenticatedIdentities: true,
+      resourceNameTruncated: 'extaut87063394',
+      userPoolName: 'extauth387063394_userpool_87063394',
+      autoVerifiedAttributes: ['email'],
+      mfaConfiguration: 'ON',
+      mfaTypes: ['SMS Text Message', 'TOTP'],
+      smsAuthenticationMessage: 'Your authentication code is {####}',
+      smsVerificationMessage: 'Your verification code is {####}',
+      emailVerificationSubject: 'Your verification code',
+      emailVerificationMessage: 'Your verification code is {####}',
+      defaultPasswordPolicy: true,
+      passwordPolicyMinLength: 8,
+      passwordPolicyCharacters: ['Requires Lowercase', 'Requires Uppercase', 'Requires Numbers', 'Requires Symbols'],
+      requiredAttributes: ['email'],
+      userpoolClientGenerateSecret: false,
+      userpoolClientRefreshTokenValidity: 30,
+      userpoolClientWriteAttributes: ['address', 'email'],
+      userpoolClientReadAttributes: ['address', 'email'],
+      userpoolClientLambdaRole: 'extaut87063394_userpoolclient_lambda_role',
+      userpoolClientSetAttributes: true,
+      sharedId: '87063394',
+      resourceName: 'extauth38706339487063394',
+      authSelections: 'identityPoolAndUserPool',
+      authRoleArn: {
+        'Fn::GetAtt': ['AuthRole', 'Arn'],
+      },
+      unauthRoleArn: {
+        'Fn::GetAtt': ['UnauthRole', 'Arn'],
+      },
+      useDefault: 'manual',
+      thirdPartyAuth: true,
+      authProviders: ['graph.facebook.com', 'accounts.google.com', 'www.amazon.com', 'appleid.apple.com'],
+      facebookAppId: 'dfvsdcsdc',
+      googleClientId: 'svsdvsv',
+      amazonAppId: 'sdsafggas',
+      appleAppId: 'gfdbvafergew',
+      userPoolGroups: true,
+      adminQueries: false,
+      triggers: {
+        CreateAuthChallenge: ['captcha-create-challenge'],
+        CustomMessage: ['verification-link'],
+        DefineAuthChallenge: ['captcha-define-challenge'],
+        PostAuthentication: ['custom'],
+        PostConfirmation: ['add-to-group'],
+        PreAuthentication: ['custom'],
+        PreSignup: ['email-filter-allowlist'],
+        VerifyAuthChallengeResponse: ['captcha-verify'],
+        PreTokenGeneration: ['alter-claims'],
+      },
+      hostedUI: true,
+      hostedUIDomainName: 'extauth387063394-87063394',
+      newCallbackURLs: ['https://localhost:3000/'],
+      newLogoutURLs: ['https://localhost:3000/'],
+      AllowedOAuthFlows: 'code',
+      AllowedOAuthScopes: ['phone', 'email', 'openid', 'profile', 'aws.cognito.signin.user.admin'],
+      authProvidersUserPool: ['Facebook', 'Google', 'LoginWithAmazon', 'SignInWithApple'],
+      facebookAppIdUserPool: 'sdcsdc',
+      facebookAppSecretUserPool: 'bfdsvsr',
+      googleAppIdUserPool: 'avearver',
+      googleAppSecretUserPool: 'vcvereger',
+      loginwithamazonAppIdUserPool: 'vercvdsavcer',
+      loginwithamazonAppSecretUserPool: 'revfdsavrtv',
+      signinwithappleClientIdUserPool: 'vfdvergver',
+      signinwithappleTeamIdUserPool: 'ervervre',
+      signinwithappleKeyIdUserPool: 'vfdavervfer',
+      signinwithapplePrivateKeyUserPool: 'vaveb',
+      selectedParties:
+        '{"graph.facebook.com":"dfvsdcsdc","accounts.google.com":"svsdvsv","www.amazon.com":"sdsafggas","appleid.apple.com":"gfdbvafergew"}',
+      hostedUIProviderMeta:
+        '[{"ProviderName":"Facebook","authorize_scopes":"email,public_profile","AttributeMapping":{"email":"email","username":"id"}},{"ProviderName":"Google","authorize_scopes":"openid email profile","AttributeMapping":{"email":"email","username":"sub"}},{"ProviderName":"LoginWithAmazon","authorize_scopes":"profile profile:user_id","AttributeMapping":{"email":"email","username":"user_id"}},{"ProviderName":"SignInWithApple","authorize_scopes":"email","AttributeMapping":{"email":"email"}}]',
+      hostedUIProviderCreds:
+        '[{"ProviderName":"Facebook","client_id":"sdcsdc","client_secret":"bfdsvsr"},{"ProviderName":"Google","client_id":"avearver","client_secret":"vcvereger"},{"ProviderName":"LoginWithAmazon","client_id":"vercvdsavcer","client_secret":"revfdsavrtv"},{"ProviderName":"SignInWithApple","client_id":"vfdvergver","team_id":"ervervre","key_id":"vfdavervfer","private_key":"vaveb"}]',
+      oAuthMetadata:
+        '{"AllowedOAuthFlows":["code"],"AllowedOAuthScopes":["phone","email","openid","profile","aws.cognito.signin.user.admin"],"CallbackURLs":["https://localhost:3000/"],"LogoutURLs":["https://localhost:3000/"]}',
+      serviceName: 'Cognito',
+      verificationBucketName: 'extauth38706339487063394verificationbucket',
+      usernameCaseSensitive: false,
+    },
+  })
+  .mockReturnValueOnce({
+    version: '1',
+    cognitoConfig: {
+      identityPoolName: 'authdefaultsettings2c33facd_identitypool_2c33facd',
+      allowUnauthenticatedIdentities: false,
+      resourceNameTruncated: 'authde2c33facd',
+      userPoolName: 'authdefaultsettings2c33facd_userpool_2c33facd',
+      autoVerifiedAttributes: ['email'],
+      mfaConfiguration: 'OFF',
+      mfaTypes: ['SMS Text Message'],
+      smsAuthenticationMessage: 'Your authentication code is {####}',
+      smsVerificationMessage: 'Your verification code is {####}',
+      emailVerificationSubject: 'Your verification code',
+      emailVerificationMessage: 'Your verification code is {####}',
+      defaultPasswordPolicy: false,
+      passwordPolicyMinLength: 8,
+      passwordPolicyCharacters: [],
+      requiredAttributes: ['email'],
+      aliasAttributes: ['email'],
+      userpoolClientGenerateSecret: false,
+      userpoolClientRefreshTokenValidity: 30,
+      userpoolClientWriteAttributes: ['email'],
+      userpoolClientReadAttributes: ['email'],
+      userpoolClientLambdaRole: 'authde2c33facd_userpoolclient_lambda_role',
+      userpoolClientSetAttributes: false,
+      sharedId: '2c33facd',
+      resourceName: 'authdefaultsettings2c33facd',
+      authSelections: 'identityPoolAndUserPool',
+      useDefault: 'default',
+      userPoolGroupList: [],
+      serviceName: 'Cognito',
+      usernameCaseSensitive: false,
+    },
+  });
+
+const isCLIInputsValid_mock = jest.fn().mockReturnValue('true');
+
+jest.mock('../../../../provider-utils/awscloudformation/auth-inputs-manager/auth-input-state.ts', () => {
+  return {
+    AuthInputState: jest.fn().mockImplementation(() => {
+      return {
+        getCLIInputPayload: getCLIInputPayload_mock,
+        isCLIInputsValid: isCLIInputsValid_mock,
+      };
+    }),
+  };
+});
+
+const context_stub = {
+  amplify: {
+    loadEnvResourceParameters: jest.fn(),
+    getTriggerPermissions: jest.fn(),
+    dependsOnBlock: jest.fn(),
+    updateamplifyMetaAfterResourceAdd: jest.fn(),
+  },
+};
+
+const context_stub_typed = context_stub as unknown as $TSContext;
+describe('Check Auth Template', () => {
+  it('Generated authstack template in manual flow', async () => {
+    // CFN transform for Auth stack
+
+    const resourceName = 'mockResource';
+    const authTransform = new AmplifyAuthTransform(resourceName);
+    const mock_template = await authTransform.transform(context_stub_typed);
+    expect(mock_template).toMatchSnapshot();
+  });
+
+  it('Generated authstack template in default flow', async () => {
+    // CFN transform for Auth stack
+
+    const resourceName = 'mockResource';
+    const authTransform = new AmplifyAuthTransform(resourceName);
+    const mock_template = await authTransform.transform(context_stub_typed);
+    expect(mock_template).toMatchSnapshot();
+  });
+});
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/user-pool-group-stack-transform.test.ts b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/user-pool-group-stack-transform.test.ts
new file mode 100644
index 00000000000..727595f8fbb
--- /dev/null
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/auth-stack-builder/user-pool-group-stack-transform.test.ts
@@ -0,0 +1,73 @@
+import { AmplifyUserPoolGroupTransform } from '../../../../provider-utils/awscloudformation/auth-stack-builder';
+import { $TSContext } from 'amplify-cli-core';
+
+jest.mock('amplify-cli-core', () => ({
+  ...(jest.requireActual('amplify-cli-core') as {}),
+  stateManager: {
+    getLocalEnvInfo: jest.fn().mockReturnValue('testenv'),
+  },
+  pathManager: {
+    getBackendDirPath: jest.fn().mockReturnValue('..'),
+  },
+  JSONUtilities: {
+    readJson: jest
+      .fn()
+      .mockReturnValueOnce([
+        {
+          groupName: 'adin',
+          precedence: 1,
+        },
+      ])
+      .mockReturnValueOnce([
+        {
+          groupName: 'adinmock',
+          precedence: 2,
+        },
+      ]),
+  },
+  buildOverrideDir: jest.fn().mockResolvedValue(false),
+  writeCFNTemplate: jest.fn(),
+}));
+
+const getCLIInputPayload_mock = jest.fn().mockReturnValue({
+  cognitoConfig: {
+    identityPoolName: 'extauth387063394_identitypool_87063394',
+    resourceName: 'extauth38706339487063394',
+  },
+});
+
+const isCLIInputsValid_mock = jest.fn().mockReturnValue('true');
+
+jest.mock('../../../../provider-utils/awscloudformation/auth-inputs-manager/auth-input-state.ts', () => {
+  return {
+    AuthInputState: jest.fn().mockImplementation(() => {
+      return {
+        getCLIInputPayload: getCLIInputPayload_mock,
+        isCLIInputsValid: isCLIInputsValid_mock,
+      };
+    }),
+  };
+});
+
+const context_stub = {};
+
+const context_stub_typed = context_stub as unknown as $TSContext;
+describe('Check UserPool Group Template', () => {
+  it('Generated rootstack template during Push one group', async () => {
+    // CFN transform for UserPool Group stack
+
+    const resourceName = 'mockResource';
+    const userPoolTransform = new AmplifyUserPoolGroupTransform(resourceName);
+    const mock_template = await userPoolTransform.transform(context_stub_typed);
+    expect(mock_template).toMatchSnapshot();
+  });
+
+  it('Generated rootstack template during Push with two groups', async () => {
+    // CFN transform for UserPool Group stack
+
+    const resourceName = 'mockResource';
+    const userPoolTransform = new AmplifyUserPoolGroupTransform(resourceName);
+    const mock_template = await userPoolTransform.transform(context_stub_typed);
+    expect(mock_template).toMatchSnapshot();
+  });
+});
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/__snapshots__/auth-request-adaptor.test.ts.snap b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/__snapshots__/auth-request-adaptor.test.ts.snap
index 7232510f91e..416409f0d9d 100644
--- a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/__snapshots__/auth-request-adaptor.test.ts.snap
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/__snapshots__/auth-request-adaptor.test.ts.snap
@@ -65,37 +65,6 @@ Object {
 }
 `;
 
-
-exports[`get add auth request adaptor translates request without aliasAttributes 1`] = `
-Object {
-  "adminQueries": false,
-  "adminQueryGroup": undefined,
-  "aliasAttributes": Array [],
-  "authProviders": Array [],
-  "authSelections": "userPoolOnly",
-  "autoVerifiedAttributes": Array [],
-  "identityPoolName": undefined,
-  "mfaConfiguration": "OFF",
-  "requiredAttributes": Array [
-    "email",
-  ],
-  "resourceName": "myTestAuth",
-  "serviceName": "Cognito",
-  "thirdPartyAuth": false,
-  "updateFlow": "manual",
-  "useDefault": "manual",
-  "userPoolGroupList": Array [],
-  "userPoolGroups": false,
-  "userPoolName": undefined,
-  "usernameAttributes": Array [
-    "email",
-  ],
-  "userpoolClientReadAttributes": Array [],
-  "userpoolClientRefreshTokenValidity": undefined,
-  "userpoolClientWriteAttributes": Array [],
-}
-`;
-
 exports[`get update auth request adaptor valid translations translates empty oAuth config into hostedUI: false 1`] = `
 Object {
   "adminQueries": false,
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/auth-defaults-appliers.test.ts b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/auth-defaults-appliers.test.ts
index 047eb302234..5d9ec9bde74 100644
--- a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/auth-defaults-appliers.test.ts
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/auth-defaults-appliers.test.ts
@@ -1,4 +1,5 @@
-import { ServiceQuestionsResult } from '../../../../provider-utils/awscloudformation/service-walkthrough-types';
+import { $TSAny, $TSContext } from 'amplify-cli-core';
+import { ServiceQuestionHeadlessResult } from '../../../../provider-utils/awscloudformation/service-walkthrough-types/cognito-user-input-types';
 import { structureOAuthMetadata } from '../../../../provider-utils/awscloudformation/service-walkthroughs/auth-questions';
 import {
   getAddAuthDefaultsApplier,
@@ -19,6 +20,7 @@ jest.mock('../../../../provider-utils/awscloudformation/service-walkthroughs/aut
 
 jest.mock('amplify-cli-core', () => {
   return {
+    ...(jest.requireActual('amplify-cli-core') as {}),
     FeatureFlags: {
       getBoolean: jest.fn().mockImplementation((name, defaultValue) => {
         if (name === 'auth.enableCaseInsensitivity') {
@@ -39,9 +41,9 @@ describe('update auth defaults applier', () => {
     const stubResult = {
       useDefault: 'manual',
       authSelections: 'userPoolOnly',
-    } as ServiceQuestionsResult;
+    } as ServiceQuestionHeadlessResult;
 
-    const result = await getUpdateAuthDefaultsApplier({}, 'cognito-defaults.js', {} as ServiceQuestionsResult)(stubResult);
+    const result = await getUpdateAuthDefaultsApplier({} as unknown as $TSContext, 'cognito-defaults.js', {} as $TSAny)(stubResult);
     expect(result).toMatchSnapshot();
     expect(structureOAuthMetadata_mock.mock.calls.length).toBe(1);
   });
@@ -51,22 +53,22 @@ describe('update auth defaults applier', () => {
       useDefault: 'manual',
       authSelections: 'userPoolOnly',
       requiredAttributes: [] as string[],
-    } as ServiceQuestionsResult;
+    } as ServiceQuestionHeadlessResult;
 
-    const result = await getUpdateAuthDefaultsApplier({}, 'cognito-defaults.js', {} as ServiceQuestionsResult)(stubResult);
+    const result = await getUpdateAuthDefaultsApplier({} as unknown as $TSContext, 'cognito-defaults.js', {} as $TSAny)(stubResult);
     expect(result.requiredAttributes).toEqual([]);
   });
 });
 
 describe('add auth defaults applier', () => {
   it('overwrites default parameters', async () => {
-    const stubResult: ServiceQuestionsResult = {
+    const stubResult: ServiceQuestionHeadlessResult = {
       useDefault: 'manual',
       authSelections: 'userPoolOnly',
       requiredAttributes: [] as string[],
-    } as ServiceQuestionsResult;
+    } as ServiceQuestionHeadlessResult;
 
-    const result = await getAddAuthDefaultsApplier({}, 'cognito-defaults.js', 'testProjectName')(stubResult);
+    const result = await getAddAuthDefaultsApplier({} as unknown as $TSContext, 'cognito-defaults.js', 'testProjectName')(stubResult);
     expect(result.requiredAttributes).toEqual([]);
   });
 });
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/auth-request-adaptor.test.ts b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/auth-request-adaptor.test.ts
index dbb62bb3689..a88463505c5 100644
--- a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/auth-request-adaptor.test.ts
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/auth-request-adaptor.test.ts
@@ -9,12 +9,8 @@ import {
   getAddAuthRequestAdaptor,
   getUpdateAuthRequestAdaptor,
 } from '../../../../provider-utils/awscloudformation/utils/auth-request-adaptors';
-import { FeatureFlags } from 'amplify-cli-core';
 
 describe('get add auth request adaptor', () => {
-  beforeEach(() => {
-    FeatureFlags.getBoolean = () => false;
-  });
   describe('valid translations', () => {
     it('translates request with minimal user pool config only', () => {
       const addAuthRequest: AddAuthRequest = {
@@ -34,28 +30,6 @@ describe('get add auth request adaptor', () => {
     });
   });
   it('translates request with aliasAttributes', () => {
-    FeatureFlags.getBoolean = () => true;
-    const addAuthRequest: AddAuthRequest = {
-      version: 1,
-      resourceName: 'myTestAuth',
-      serviceConfiguration: {
-        serviceName: 'Cognito',
-        userPoolConfiguration: {
-          signinMethod: CognitoUserPoolSigninMethod.EMAIL,
-          requiredSignupAttributes: [CognitoUserProperty.EMAIL],
-          aliasAttributes: [
-            CognitoUserAliasAttributes.EMAIL,
-            CognitoUserAliasAttributes.PHONE_NUMBER,
-            CognitoUserAliasAttributes.PREFERRED_USERNAME,
-          ],
-        },
-        includeIdentityPool: false,
-      },
-    };
-
-    expect(getAddAuthRequestAdaptor('javascript')(addAuthRequest)).toMatchSnapshot();
-  });
-  it('translates request without aliasAttributes', () => {
     const addAuthRequest: AddAuthRequest = {
       version: 1,
       resourceName: 'myTestAuth',
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/auth-sms-workflow-helper.test.ts b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/auth-sms-workflow-helper.test.ts
index b2efbd873db..8640a41915f 100644
--- a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/auth-sms-workflow-helper.test.ts
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/auth-sms-workflow-helper.test.ts
@@ -1,10 +1,9 @@
-import { FeatureFlags } from 'amplify-cli-core';
-FeatureFlags.getBoolean = () => false;
-import { ServiceQuestionsResult, AttributeType } from '../../../../provider-utils/awscloudformation/service-walkthrough-types';
+import { CognitoConfiguration } from '../../../../provider-utils/awscloudformation/service-walkthrough-types/awsCognito-user-input-types';
+import { AttributeType } from '../../../../provider-utils/awscloudformation/service-walkthrough-types/cognito-user-input-types';
 import { doesConfigurationIncludeSMS } from '../../../../provider-utils/awscloudformation/utils/auth-sms-workflow-helper';
 
 describe('doesConfigurationIncludeSMS', () => {
-  let request: ServiceQuestionsResult;
+  let request: CognitoConfiguration;
 
   beforeEach(() => {
     request = {
@@ -21,6 +20,9 @@ describe('doesConfigurationIncludeSMS', () => {
       userPoolGroups: false,
       userpoolClientReadAttributes: [],
       userpoolClientWriteAttributes: [],
+      userpoolClientGenerateSecret: false,
+      userpoolClientLambdaRole: 'lambdarole',
+      resourceName: 'resourceName',
     };
   });
 
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/check-for-auth-migration.test.ts b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/check-for-auth-migration.test.ts
new file mode 100644
index 00000000000..c70d90ac470
--- /dev/null
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/check-for-auth-migration.test.ts
@@ -0,0 +1,79 @@
+import { migrateResourceToSupportOverride } from '../../../../provider-utils/awscloudformation/utils/migrate-override-resource';
+import { generateAuthStackTemplate } from '../../../../provider-utils/awscloudformation/utils/generate-auth-stack-template';
+import { $TSContext, generateOverrideSkeleton } from 'amplify-cli-core';
+import { AuthInputState } from '../../../../provider-utils/awscloudformation/auth-inputs-manager/auth-input-state';
+import { checkAuthResourceMigration } from '../../../../provider-utils/awscloudformation/utils/check-for-auth-migration';
+
+jest.mock('../../../../provider-utils/awscloudformation/auth-inputs-manager/auth-input-state');
+
+jest.mock('fs-extra');
+
+jest.mock('amplify-prompts', () => ({
+  printer: {
+    warn: jest.fn(),
+    debug: jest.fn(),
+  },
+  prompter: {
+    confirmContinue: jest.fn().mockReturnValue(true),
+    pick: jest.fn().mockReturnValue('mockResource'),
+  },
+}));
+
+jest.mock('amplify-cli-core', () => ({
+  ...(jest.requireActual('amplify-cli-core') as {}),
+  stateManager: {
+    getMeta: jest.fn().mockReturnValue({
+      auth: {
+        mockResource1: {},
+      },
+    }),
+  },
+  pathManager: {
+    getBackendDirPath: jest.fn().mockReturnValue('mockDirPath'),
+  },
+  generateOverrideSkeleton: jest.fn(),
+}));
+
+jest.mock('../../../../provider-utils/awscloudformation/utils/migrate-override-resource', () => ({
+  migrateResourceToSupportOverride: jest.fn(),
+}));
+
+jest.mock('../../../../provider-utils/awscloudformation/utils/generate-auth-stack-template', () => ({
+  generateAuthStackTemplate: jest.fn(),
+}));
+
+test('migration gets called when cli-inputs doesnt exist', async () => {
+  jest.spyOn(AuthInputState.prototype, 'cliInputFileExists').mockImplementation(() => false);
+  jest.spyOn(AuthInputState.prototype, 'getCLIInputPayload').mockReturnValue({
+    version: '1',
+    cognitoConfig: {
+      authSelections: 'identityPoolAndUserPool',
+      autoVerifiedAttributes: ['mock'],
+      mfaConfiguration: 'OFF',
+      requiredAttributes: ['mock'],
+      resourceName: 'mockResource',
+      useDefault: 'default',
+      userpoolClientGenerateSecret: true,
+      userpoolClientLambdaRole: 'lambda',
+      userpoolClientReadAttributes: ['mockAttributes'],
+      userpoolClientWriteAttributes: ['mockAttributes'],
+      AllowedOAuthFlows: 'code',
+      AllowedOAuthScopes: ['mockScope'],
+      serviceName: 'Cognito',
+    },
+  });
+
+  await checkAuthResourceMigration({} as unknown as $TSContext, 'mockResource');
+  expect(migrateResourceToSupportOverride).toBeCalled();
+  expect(generateAuthStackTemplate).toBeCalled();
+});
+
+test('migration doesnt called when cli-inputs exist', async () => {
+  jest.clearAllMocks();
+  jest.spyOn(AuthInputState.prototype, 'cliInputFileExists').mockImplementation(() => true);
+  jest.spyOn(AuthInputState.prototype, 'getCLIInputPayload');
+
+  await checkAuthResourceMigration({} as unknown as $TSContext, 'mockResource');
+  expect(migrateResourceToSupportOverride).not.toBeCalled();
+  expect(generateAuthStackTemplate).not.toBeCalled();
+});
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/message-printer.test.ts b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/message-printer.test.ts
index d6bbaee837c..cad6f8fef04 100644
--- a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/message-printer.test.ts
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/message-printer.test.ts
@@ -1,10 +1,10 @@
 import { printSMSSandboxWarning } from '../../../../provider-utils/awscloudformation/utils/message-printer';
 import { BannerMessage } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
 import os from 'os';
 jest.mock('amplify-cli-core');
-const printMock = {
-  warning: jest.fn(),
-};
+
+jest.mock('amplify-prompts');
 
 describe('printSMSSandboxWarning', () => {
   const mockedGetMessage = jest.spyOn(BannerMessage, 'getMessage');
@@ -16,15 +16,15 @@ describe('printSMSSandboxWarning', () => {
   it('should print warning when the message is present', async () => {
     const message = 'BannerMessage';
     mockedGetMessage.mockResolvedValueOnce(message);
-    await printSMSSandboxWarning(printMock);
-    expect(printMock.warning).toHaveBeenCalledWith(`${message}${os.EOL}`);
+    await printSMSSandboxWarning();
+    expect(printer.warn).toHaveBeenCalledWith(`${message}${os.EOL}`);
     expect(mockedGetMessage).toHaveBeenCalledWith('COGNITO_SMS_SANDBOX_CATEGORY_AUTH_ADD_OR_UPDATE_INFO');
   });
 
   it('should not print warning when the banner message is missing', async () => {
     mockedGetMessage.mockResolvedValueOnce(undefined);
-    await printSMSSandboxWarning(printMock);
-    expect(printMock.warning).not.toHaveBeenCalled();
+    await printSMSSandboxWarning();
+    expect(printer.warn).not.toHaveBeenCalled();
     expect(mockedGetMessage).toHaveBeenCalledWith('COGNITO_SMS_SANDBOX_CATEGORY_AUTH_ADD_OR_UPDATE_INFO');
   });
 });
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/migrate-override-resource.test.ts b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/migrate-override-resource.test.ts
new file mode 100644
index 00000000000..6bdf69b5545
--- /dev/null
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/migrate-override-resource.test.ts
@@ -0,0 +1,128 @@
+import { JSONUtilities } from 'amplify-cli-core';
+import { migrateResourceToSupportOverride } from '../../../../provider-utils/awscloudformation/utils/migrate-override-resource';
+import * as path from 'path';
+
+jest.mock('amplify-prompts');
+jest.mock('fs-extra');
+
+jest.mock('amplify-cli-core', () => ({
+  pathManager: {
+    findProjectRoot: jest.fn().mockReturnValue('somePath'),
+    getBackendDirPath: jest.fn().mockReturnValue('mockProjectPath'),
+  },
+  JSONUtilities: {
+    readJson: jest.fn().mockReturnValue({
+      identityPoolName: 'authdefaultsettingsp1b7b273e_identitypool_1b7b273e',
+      allowUnauthenticatedIdentities: false,
+      resourceNameTruncated: 'authde1b7b273e',
+      userPoolName: 'authdefaultsettingsp1b7b273e_userpool_1b7b273e',
+      autoVerifiedAttributes: ['email'],
+      mfaConfiguration: 'OFF',
+      mfaTypes: ['SMS Text Message'],
+      smsAuthenticationMessage: 'Your authentication code is {####}',
+      smsVerificationMessage: 'Your verification code is {####}',
+      emailVerificationSubject: 'Your verification code',
+      emailVerificationMessage: 'Your verification code is {####}',
+      defaultPasswordPolicy: false,
+      passwordPolicyMinLength: 8,
+      passwordPolicyCharacters: [],
+      requiredAttributes: ['email'],
+      aliasAttributes: ['email'],
+      userpoolClientGenerateSecret: false,
+      userpoolClientRefreshTokenValidity: 30,
+      userpoolClientWriteAttributes: ['email'],
+      userpoolClientReadAttributes: ['email'],
+      userpoolClientLambdaRole: 'authde1b7b273e_userpoolclient_lambda_role',
+      userpoolClientSetAttributes: false,
+      sharedId: '1b7b273e',
+      resourceName: 'mockResource',
+      authSelections: 'identityPoolAndUserPool',
+      authRoleArn: {
+        'Fn::GetAtt': ['AuthRole', 'Arn'],
+      },
+      unauthRoleArn: {
+        'Fn::GetAtt': ['UnauthRole', 'Arn'],
+      },
+      useDefault: 'default',
+      userPoolGroupList: [],
+      serviceName: 'Cognito',
+      usernameCaseSensitive: false,
+      dependsOn: [
+        {
+          category: 'function',
+          resourceName: 'authdefaultsettingsp1b7b273ePostAuthentication',
+          triggerProvider: 'Cognito',
+          attributes: ['Arn', 'Name'],
+        },
+        {
+          category: 'function',
+          resourceName: 'authdefaultsettingsp1b7b273ePostConfirmation',
+          triggerProvider: 'Cognito',
+          attributes: ['Arn', 'Name'],
+        },
+      ],
+      userPoolGroups: false,
+      adminQueries: false,
+      triggers: '{\n  "PostAuthentication": [\n    "custom"\n  ],\n  "PostConfirmation": [\n    "add-to-group"\n  ]\n}',
+      hostedUI: false,
+      parentStack: {
+        Ref: 'AWS::StackId',
+      },
+      authTriggerConnections:
+        '[\n  {\n    "triggerType": "PostAuthentication",\n    "lambdaFunctionName": "authdefaultsettingsp1b7b273ePostAuthentication"\n  },\n  {\n    "triggerType": "PostConfirmation",\n    "lambdaFunctionName": "authdefaultsettingsp1b7b273ePostConfirmation"\n  }\n]',
+      breakCircularDependency: true,
+      permissions: [
+        '{\n  "policyName": "AddToGroupCognito",\n  "trigger": "PostConfirmation",\n  "effect": "Allow",\n  "actions": [\n    "cognito-idp:AdminAddUserToGroup",\n    "cognito-idp:GetGroup",\n    "cognito-idp:CreateGroup"\n  ],\n  "resource": {\n    "paramType": "!GetAtt",\n    "keys": [\n      "UserPool",\n      "Arn"\n    ]\n  }\n}',
+      ],
+      authProviders: [],
+    }),
+    writeJson: jest.fn(),
+  },
+}));
+test('migrate resource', async () => {
+  const resourceName = 'mockResource';
+  migrateResourceToSupportOverride(resourceName);
+  const expectedPath = path.join('mockProjectPath', 'auth', resourceName, 'cli-inputs.json');
+  const expectedPayload = {
+    version: '1',
+    cognitoConfig: {
+      authSelections: 'identityPoolAndUserPool',
+      requiredAttributes: ['email'],
+      resourceName: 'mockResource',
+      serviceName: 'Cognito',
+      useDefault: 'default',
+      userpoolClientReadAttributes: ['email'],
+      userpoolClientWriteAttributes: ['email'],
+      aliasAttributes: ['email'],
+      resourceNameTruncated: 'authde1b7b273e',
+      sharedId: '1b7b273e',
+      userPoolGroupList: [],
+      userPoolGroups: false,
+      userPoolName: 'authdefaultsettingsp1b7b273e_userpool_1b7b273e',
+      usernameCaseSensitive: false,
+      userpoolClientRefreshTokenValidity: 30,
+      userpoolClientSetAttributes: false,
+      userpoolClientGenerateSecret: false,
+      userpoolClientLambdaRole: 'authde1b7b273e_userpoolclient_lambda_role',
+      passwordPolicyCharacters: [],
+      passwordPolicyMinLength: 8,
+      adminQueries: false,
+      mfaConfiguration: 'OFF',
+      mfaTypes: ['SMS Text Message'],
+      smsAuthenticationMessage: 'Your authentication code is {####}',
+      emailVerificationMessage: 'Your verification code is {####}',
+      emailVerificationSubject: 'Your verification code',
+      smsVerificationMessage: 'Your verification code is {####}',
+      autoVerifiedAttributes: ['email'],
+      hostedUI: false,
+      identityPoolName: 'authdefaultsettingsp1b7b273e_identitypool_1b7b273e',
+      allowUnauthenticatedIdentities: false,
+      authProviders: [],
+      triggers: {
+        PostAuthentication: ['custom'],
+        PostConfirmation: ['add-to-group'],
+      },
+    },
+  };
+  expect(JSONUtilities.writeJson).toBeCalledWith(expectedPath, expectedPayload);
+});
diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/supported-services.test.ts b/packages/amplify-category-auth/src/__tests__/provider-utils/supported-services.test.ts
deleted file mode 100644
index 7594a406ff7..00000000000
--- a/packages/amplify-category-auth/src/__tests__/provider-utils/supported-services.test.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import { FeatureFlags } from 'amplify-cli-core';
-import { getSupportedServices } from '../../provider-utils/supported-services';
-
-describe('auth.forceAliasAttributes feature flag works', () => {
-  it('when flag is false, usernameAttributes are used instead of aliasAttributes', async () => {
-    FeatureFlags.getBoolean = () => false;
-    const result = getSupportedServices();
-
-    const usernameAttributesInput = result.Cognito.inputs.find((input: any) => input.key === 'usernameAttributes');
-    expect(usernameAttributesInput).toEqual(
-      expect.objectContaining({
-        key: 'usernameAttributes',
-      }),
-    );
-
-    const aliasAttributesInput = result.Cognito.inputs.find((input: any) => input.key === 'aliasAttributes');
-    expect(aliasAttributesInput).toBeFalsy();
-  });
-  it('when flag is true, aliasAttributes are used instead of usernameAttributes', async () => {
-    FeatureFlags.getBoolean = () => true;
-    const result = getSupportedServices();
-
-    const usernameAttributesInput = result.Cognito.inputs.find((input: any) => input.key === 'usernameAttributes');
-    expect(usernameAttributesInput).toBeFalsy();
-
-    const aliasAttributesInput = result.Cognito.inputs.find((input: any) => input.key === 'aliasAttributes');
-    expect(aliasAttributesInput).toEqual(
-      expect.objectContaining({
-        key: 'aliasAttributes',
-      }),
-    );
-  });
-});
diff --git a/packages/amplify-category-auth/src/commands/auth.js b/packages/amplify-category-auth/src/commands/auth.js
deleted file mode 100644
index 8177939afe5..00000000000
--- a/packages/amplify-category-auth/src/commands/auth.js
+++ /dev/null
@@ -1,47 +0,0 @@
-const featureName = 'auth';
-
-module.exports = {
-  name: featureName,
-  run: async context => {
-    if (/^win/.test(process.platform)) {
-      try {
-        const { run } = require(`./${featureName}/${context.parameters.first}`);
-        return run(context);
-      } catch (e) {
-        context.print.error('Command not found');
-      }
-    }
-    const header = `amplify ${featureName} <subcommands>`;
-
-    const commands = [
-      {
-        name: 'add',
-        description: `Takes you through a CLI flow to add an ${featureName} resource to your local backend`,
-      },
-      {
-        name: 'import',
-        description: `Takes you through a CLI flow to import an existing ${featureName} resource to your local backend`,
-      },
-      {
-        name: 'push',
-        description: `Provisions only ${featureName} cloud resources with the latest local developments`,
-      },
-      {
-        name: 'remove',
-        description: `Removes the ${featureName} resource from your local backend which would be removed from the cloud on the next push command`,
-      },
-      {
-        name: 'update',
-        description: `Updates the ${featureName} resource from your local backend.`,
-      },
-      {
-        name: 'console',
-        description: `Opens the web console for the ${featureName} category`,
-      },
-    ];
-
-    context.amplify.showHelp(header, commands);
-
-    context.print.info('');
-  },
-};
diff --git a/packages/amplify-category-auth/src/commands/auth.ts b/packages/amplify-category-auth/src/commands/auth.ts
new file mode 100644
index 00000000000..bffdd04e648
--- /dev/null
+++ b/packages/amplify-category-auth/src/commands/auth.ts
@@ -0,0 +1,49 @@
+import { $TSContext } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
+import * as path from 'path';
+
+export const name = 'auth';
+
+type AuthCommandType = {
+  name: string;
+  description: string;
+};
+
+export const run = async (context: $TSContext) => {
+  try {
+    const { run } = await import(path.join('.', name, context.parameters.first));
+    return run(context);
+  } catch (err) {
+    const header = `amplify ${name} <subcommands>`;
+
+    const commands: AuthCommandType[] = [
+      {
+        name: 'add',
+        description: `Takes you through a CLI flow to add an ${name} resource to your local backend`,
+      },
+      {
+        name: 'import',
+        description: `Takes you through a CLI flow to import an existing ${name} resource to your local backend`,
+      },
+      {
+        name: 'push',
+        description: `Provisions only ${name} cloud resources with the latest local developments`,
+      },
+      {
+        name: 'remove',
+        description: `Removes the ${name} resource from your local backend which would be removed from the cloud on the next push command`,
+      },
+      {
+        name: 'update',
+        description: `Updates the ${name} resource from your local backend.`,
+      },
+      {
+        name: 'console',
+        description: `Opens the web console for the ${name} category`,
+      },
+    ];
+
+    context.amplify.showHelp(header, commands);
+    printer.blankLine();
+  }
+};
diff --git a/packages/amplify-category-auth/src/commands/auth/add.js b/packages/amplify-category-auth/src/commands/auth/add.js
deleted file mode 100644
index 6f2bf53946e..00000000000
--- a/packages/amplify-category-auth/src/commands/auth/add.js
+++ /dev/null
@@ -1,6 +0,0 @@
-const enable = require('./enable');
-
-module.exports = {
-  name: 'add',
-  run: enable.run,
-};
diff --git a/packages/amplify-category-auth/src/commands/auth/add.ts b/packages/amplify-category-auth/src/commands/auth/add.ts
new file mode 100644
index 00000000000..044e804fb27
--- /dev/null
+++ b/packages/amplify-category-auth/src/commands/auth/add.ts
@@ -0,0 +1,8 @@
+import { $TSContext } from 'amplify-cli-core';
+import * as enable from './enable';
+
+export const name = 'add';
+
+export const run = async (context: $TSContext) => {
+  return enable.run(context);
+};
diff --git a/packages/amplify-category-auth/src/commands/auth/console.js b/packages/amplify-category-auth/src/commands/auth/console.js
deleted file mode 100644
index fd45bcd7c84..00000000000
--- a/packages/amplify-category-auth/src/commands/auth/console.js
+++ /dev/null
@@ -1,9 +0,0 @@
-const subcommand = 'console';
-const indexModule = require('../../index');
-
-module.exports = {
-  name: subcommand,
-  run: async context => {
-    await indexModule.console(context);
-  },
-};
diff --git a/packages/amplify-category-auth/src/commands/auth/console.ts b/packages/amplify-category-auth/src/commands/auth/console.ts
new file mode 100644
index 00000000000..9eb0613d0bd
--- /dev/null
+++ b/packages/amplify-category-auth/src/commands/auth/console.ts
@@ -0,0 +1,5 @@
+import { console } from '../..';
+
+export const subcommand = 'console';
+
+export const run = console;
diff --git a/packages/amplify-category-auth/src/commands/auth/enable.js b/packages/amplify-category-auth/src/commands/auth/enable.js
deleted file mode 100644
index 70ae23b211d..00000000000
--- a/packages/amplify-category-auth/src/commands/auth/enable.js
+++ /dev/null
@@ -1,24 +0,0 @@
-const { projectHasAuth } = require('../../provider-utils/awscloudformation/utils/project-has-auth');
-const { getSupportedServices } = require('../../provider-utils/supported-services');
-const subcommand = 'enable';
-const category = 'auth';
-
-module.exports = {
-  name: subcommand,
-  alias: ['add'],
-  run: async context => {
-    if (projectHasAuth(context)) {
-      return;
-    }
-    const { amplify } = context;
-    const servicesMetadata = getSupportedServices();
-    return amplify.serviceSelectionPrompt(context, category, servicesMetadata).then(result => {
-      const providerController = require(`../../provider-utils/${result.providerName}/index`);
-      if (!providerController) {
-        context.print.error('Provider not configured for this category');
-        return;
-      }
-      return providerController.addResource(context, result.service);
-    });
-  },
-};
diff --git a/packages/amplify-category-auth/src/commands/auth/enable.ts b/packages/amplify-category-auth/src/commands/auth/enable.ts
new file mode 100644
index 00000000000..ac5fa032d98
--- /dev/null
+++ b/packages/amplify-category-auth/src/commands/auth/enable.ts
@@ -0,0 +1,23 @@
+import { $TSContext } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
+import * as path from 'path';
+import { projectHasAuth } from '../../provider-utils/awscloudformation/utils/project-has-auth';
+import { supportedServices } from '../../provider-utils/supported-services';
+
+export const name = 'enable';
+export const category = 'auth';
+export const alias = ['add'];
+
+export const run = async (context: $TSContext) => {
+  if (projectHasAuth(context)) {
+    return;
+  }
+  const { amplify } = context;
+  const serviceSelectionPromptResult = await amplify.serviceSelectionPrompt(context, category, supportedServices);
+  const providerController = await import(path.join(`..`, `..`, `provider-utils`, `${serviceSelectionPromptResult.providerName}`, `index`));
+  if (!providerController) {
+    printer.error('Provider not configured for this category');
+    return;
+  }
+  return providerController.addResource(context, serviceSelectionPromptResult.service);
+};
diff --git a/packages/amplify-category-auth/src/commands/auth/import.ts b/packages/amplify-category-auth/src/commands/auth/import.ts
index 41b7a2d3cf1..9ffd1330849 100644
--- a/packages/amplify-category-auth/src/commands/auth/import.ts
+++ b/packages/amplify-category-auth/src/commands/auth/import.ts
@@ -1,6 +1,7 @@
 import { $TSContext } from 'amplify-cli-core';
 import { projectHasAuth } from '../../provider-utils/awscloudformation/utils/project-has-auth';
-const { getSupportedServices } = require('../../provider-utils/supported-services');
+import { supportedServices } from '../../provider-utils/supported-services';
+import { importResource } from '../../provider-utils/awscloudformation';
 
 const category = 'auth';
 
@@ -8,10 +9,7 @@ export const run = async (context: $TSContext) => {
   if (projectHasAuth(context)) {
     return;
   }
-  const servicesMetadata = getSupportedServices();
 
-  const serviceSelection = await context.amplify.serviceSelectionPrompt(context, category, servicesMetadata);
-  const providerController = require(`../../provider-utils/${serviceSelection.providerName}`);
-
-  return providerController.importResource(context, serviceSelection);
+  const serviceSelection = await context.amplify.serviceSelectionPrompt(context, category, supportedServices);
+  return importResource(context, serviceSelection, undefined);
 };
diff --git a/packages/amplify-category-auth/src/commands/auth/override.ts b/packages/amplify-category-auth/src/commands/auth/override.ts
new file mode 100644
index 00000000000..a1992e2e1f1
--- /dev/null
+++ b/packages/amplify-category-auth/src/commands/auth/override.ts
@@ -0,0 +1,31 @@
+import path from 'path';
+import { generateOverrideSkeleton, $TSContext, stateManager, pathManager } from 'amplify-cli-core';
+import { printer, prompter } from 'amplify-prompts';
+import { checkAuthResourceMigration } from '../../provider-utils/awscloudformation/utils/check-for-auth-migration';
+
+const category = 'auth';
+
+export const name = 'overrides';
+
+export const run = async (context: $TSContext) => {
+  const amplifyMeta = stateManager.getMeta();
+  const authResources: string[] = [];
+  Object.keys(amplifyMeta[category]).forEach(resourceName => {
+    authResources.push(resourceName);
+  });
+  if (authResources.length === 0) {
+    const errMessage = 'No auth resources to override. Add auth using `amplify add auth`';
+    printer.error(errMessage);
+    return;
+  }
+
+  const selectedAuthResource = await prompter.pick<'one', string>(`Which resource would you like to add overrides for?`, authResources);
+  // check if migration needed
+  await checkAuthResourceMigration(context, selectedAuthResource);
+  const backendDir = pathManager.getBackendDirPath();
+
+  const destPath = path.normalize(path.join(backendDir, category, selectedAuthResource));
+  const srcPath = path.normalize(path.join(__dirname, '..', '..', '..', 'resources', 'overrides-resource'));
+
+  await generateOverrideSkeleton(context, srcPath, destPath);
+};
diff --git a/packages/amplify-category-auth/src/commands/auth/push.js b/packages/amplify-category-auth/src/commands/auth/push.js
deleted file mode 100644
index 913f8a0a500..00000000000
--- a/packages/amplify-category-auth/src/commands/auth/push.js
+++ /dev/null
@@ -1,23 +0,0 @@
-const subcommand = 'push';
-const category = 'auth';
-const { uploadFiles } = require('../../provider-utils/awscloudformation/utils/trigger-file-uploader');
-
-module.exports = {
-  name: subcommand,
-  run: async context => {
-    const { amplify, parameters } = context;
-    const resourceName = parameters.first;
-    context.amplify.constructExeInfo(context);
-    return amplify
-      .pushResources(context, category, resourceName)
-      .then(async () => {
-        await uploadFiles(context);
-      })
-      .catch(err => {
-        context.print.info(err.stack);
-        context.print.error('There was an error pushing the auth resource');
-        context.usageData.emitError(err);
-        process.exitCode = 1;
-      });
-  },
-};
diff --git a/packages/amplify-category-auth/src/commands/auth/push.ts b/packages/amplify-category-auth/src/commands/auth/push.ts
new file mode 100644
index 00000000000..b38bac100e2
--- /dev/null
+++ b/packages/amplify-category-auth/src/commands/auth/push.ts
@@ -0,0 +1,22 @@
+import { $TSContext } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
+import { uploadFiles } from '../../provider-utils/awscloudformation/utils/trigger-file-uploader';
+
+export const name = 'push';
+const category = 'auth';
+
+export const run = async (context: $TSContext) => {
+  const { amplify, parameters } = context;
+  const resourceName = parameters.first;
+  context.amplify.constructExeInfo(context);
+  try {
+    const result = await amplify.pushResources(context, category, resourceName);
+    await uploadFiles(context);
+    return result;
+  } catch (err) {
+    printer.info(err.stack);
+    printer.error('There was an error pushing the auth resource');
+    context.usageData.emitError(err);
+    process.exitCode = 1;
+  }
+};
diff --git a/packages/amplify-category-auth/src/commands/auth/remove.js b/packages/amplify-category-auth/src/commands/auth/remove.js
deleted file mode 100644
index 61f8f432b74..00000000000
--- a/packages/amplify-category-auth/src/commands/auth/remove.js
+++ /dev/null
@@ -1,49 +0,0 @@
-const { BannerMessage, FeatureFlags, pathManager } = require('amplify-cli-core');
-const { printer } = require('amplify-prompts');
-const fs = require('fs');
-const { messages } = require('../../provider-utils/awscloudformation/assets/string-maps');
-
-const subcommand = 'remove';
-const category = 'auth';
-
-module.exports = {
-  name: subcommand,
-  run: async context => {
-    const { amplify, parameters } = context;
-    const resourceName = parameters.first;
-
-    const meta = amplify.getProjectDetails().amplifyMeta;
-    const dependentResources = Object.keys(meta).some(e => {
-      //eslint-disable-line
-      return ['analytics', 'api', 'storage', 'function'].includes(e) && Object.keys(meta[e]).length > 0;
-    });
-
-    if (dependentResources) {
-      printer.info(messages.dependenciesExists);
-    }
-
-    const existingAuth = meta.auth || {};
-    if (Object.keys(existingAuth).length > 0) {
-      const services = Object.keys(existingAuth);
-      for (const service of services) {
-        const serviceMeta = existingAuth[service];
-        if (serviceMeta.service === 'Cognito' && !FeatureFlags.getBoolean('auth.forceAliasAttributes')) {
-          const authAttributes = JSON.parse(
-            fs.readFileSync(pathManager.getResourceParametersFilePath(pathManager.findProjectRoot(), 'auth', service)).toString(),
-          );
-          if (authAttributes.aliasAttributes && authAttributes.aliasAttributes.length > 0) {
-            const authRemoveWarning = await BannerMessage.getMessage('AMPLIFY_REMOVE_AUTH_ALIAS_ATTRIBUTES_WARNING');
-            printer.warn(authRemoveWarning);
-          }
-        }
-      }
-    }
-
-    return amplify.removeResource(context, category, resourceName).catch(async err => {
-      printer.info(err.stack);
-      printer.error('There was an error removing the auth resource');
-      await context.usageData.emitError(err);
-      process.exitCode = 1;
-    });
-  },
-};
diff --git a/packages/amplify-category-auth/src/commands/auth/remove.ts b/packages/amplify-category-auth/src/commands/auth/remove.ts
new file mode 100644
index 00000000000..70a9d7511bc
--- /dev/null
+++ b/packages/amplify-category-auth/src/commands/auth/remove.ts
@@ -0,0 +1,37 @@
+export const name = 'remove';
+const category = 'auth';
+import { $TSContext, AmplifySupportedService, stateManager } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
+import { messages } from '../../provider-utils/awscloudformation/assets/string-maps';
+import { AuthInputState } from '../../provider-utils/awscloudformation/auth-inputs-manager/auth-input-state';
+
+export const run = async (context: $TSContext) => {
+  const { amplify, parameters } = context;
+  const resourceName = parameters.first;
+  const meta = stateManager.getMeta();
+  const dependentResources = Object.keys(meta).some(e => {
+    return ['analytics', 'api', 'storage', 'function'].includes(e) && Object.keys(meta[e]).length > 0;
+  });
+  if (dependentResources) {
+    printer.info(messages.dependenciesExists);
+  }
+  const authResourceName = Object.keys(meta.auth).filter(resourceKey => {
+    return meta.auth[resourceKey].service === AmplifySupportedService.COGNITO;
+  });
+
+  try {
+    const resource = await amplify.removeResource(context, category, resourceName);
+    if (resource?.service === AmplifySupportedService.COGNITOUSERPOOLGROUPS) {
+      // update cli input here
+      const cliState = new AuthInputState(authResourceName[0]);
+      const cliInputPayload = cliState.getCLIInputPayload();
+      cliInputPayload.cognitoConfig.userPoolGroupList = [];
+      cliState.saveCLIInputPayload(cliInputPayload);
+    }
+  } catch (err) {
+    printer.info(err.stack);
+    printer.error('There was an error removing the auth resource');
+    context.usageData.emitError(err);
+    process.exitCode = 1;
+  }
+};
diff --git a/packages/amplify-category-auth/src/commands/auth/update.js b/packages/amplify-category-auth/src/commands/auth/update.js
deleted file mode 100644
index cbe9be4773d..00000000000
--- a/packages/amplify-category-auth/src/commands/auth/update.js
+++ /dev/null
@@ -1,98 +0,0 @@
-const { messages } = require('../../provider-utils/awscloudformation/assets/string-maps');
-const { getAuthResourceName } = require('../../utils/getAuthResourceName');
-const { transformUserPoolGroupSchema } = require('../../provider-utils/awscloudformation/utils/transform-user-pool-group');
-const path = require('path');
-const fs = require('fs');
-const { category } = require('../..');
-const { attachPrevParamsToContext } = require('../../provider-utils/awscloudformation/utils/attach-prev-params-to-context');
-const { FeatureFlags, pathManager, BannerMessage } = require('amplify-cli-core');
-const { printer } = require('amplify-prompts');
-const { getSupportedServices } = require('../../provider-utils/supported-services');
-
-const subcommand = 'update';
-let options;
-
-module.exports = {
-  name: subcommand,
-  alias: ['update'],
-  run: async context => {
-    const { amplify } = context;
-    const servicesMetadata = getSupportedServices();
-    const existingAuth = amplify.getProjectDetails().amplifyMeta.auth || {};
-
-    if (!Object.keys(existingAuth).length > 0) {
-      return context.print.warning('Auth has not yet been added to this project.');
-    } else {
-      const services = Object.keys(existingAuth);
-
-      for (let i = 0; i < services.length; i++) {
-        const serviceMeta = existingAuth[services[i]];
-
-        if (serviceMeta.service === 'Cognito' && serviceMeta.mobileHubMigrated === true) {
-          context.print.error('Auth is migrated from Mobile Hub and cannot be updated with Amplify CLI.');
-          return context;
-        } else if (serviceMeta.service === 'Cognito' && serviceMeta.serviceType === 'imported') {
-          context.print.error('Updating of imported Auth resources is not supported.');
-          return context;
-        } else if (serviceMeta.service === 'Cognito' && !FeatureFlags.getBoolean('auth.forceAliasAttributes')) {
-          const authAttributes = JSON.parse(
-            fs.readFileSync(pathManager.getResourceParametersFilePath(undefined, 'auth', services[i])).toString(),
-          );
-          if (authAttributes.aliasAttributes && authAttributes.aliasAttributes.length > 0) {
-            const authUpdateWarning = await BannerMessage.getMessage('AMPLIFY_UPDATE_AUTH_ALIAS_ATTRIBUTES_WARNING');
-            printer.warn(authUpdateWarning);
-          }
-        }
-      }
-    }
-
-    context.print.info('Please note that certain attributes may not be overwritten if you choose to use defaults settings.');
-
-    const meta = amplify.getProjectDetails().amplifyMeta;
-    const dependentResources = Object.keys(meta).some(e => {
-      //eslint-disable-line
-      return ['analytics', 'api', 'storage', 'function'].includes(e) && Object.keys(meta[e]).length > 0;
-    });
-
-    if (dependentResources) {
-      context.print.info(messages.dependenciesExists);
-    }
-
-    const resourceName = await getAuthResourceName(context);
-    const providerPlugin = context.amplify.getPluginInstance(context, servicesMetadata.Cognito.provider);
-    context.updatingAuth = providerPlugin.loadResourceParameters(context, 'auth', resourceName);
-
-    return amplify
-      .serviceSelectionPrompt(context, category, servicesMetadata)
-      .then(result => {
-        options = {
-          service: result.service,
-          providerPlugin: result.providerName,
-          resourceName,
-        };
-        const providerController = require(`../../provider-utils/${result.providerName}/index`);
-        if (!providerController) {
-          context.print.error('Provider not configured for this category');
-          return;
-        }
-        return providerController.updateResource(context, options);
-      })
-      .then(async name => {
-        const { print } = context;
-        print.success(`Successfully updated resource ${name} locally`);
-        print.info('');
-        print.success('Some next steps:');
-        print.info('"amplify push" will build all your local backend resources and provision it in the cloud');
-        print.info(
-          '"amplify publish" will build all your local backend and frontend resources (if you have hosting category added) and provision it in the cloud',
-        );
-        print.info('');
-      })
-      .catch(err => {
-        context.print.info(err.stack);
-        context.print.error('There was an error adding the auth resource');
-        context.usageData.emitError(err);
-        process.exitCode = 1;
-      });
-  },
-};
diff --git a/packages/amplify-category-auth/src/commands/auth/update.ts b/packages/amplify-category-auth/src/commands/auth/update.ts
new file mode 100644
index 00000000000..75bdc692dce
--- /dev/null
+++ b/packages/amplify-category-auth/src/commands/auth/update.ts
@@ -0,0 +1,75 @@
+import { messages } from '../../provider-utils/awscloudformation/assets/string-maps';
+import { getAuthResourceName } from '../../utils/getAuthResourceName';
+import { category } from '../..';
+import { $TSContext, stateManager } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
+import { AuthInputState } from '../../provider-utils/awscloudformation/auth-inputs-manager/auth-input-state';
+import _ from 'lodash';
+import { checkAuthResourceMigration } from '../../provider-utils/awscloudformation/utils/check-for-auth-migration';
+import { supportedServices } from '../../provider-utils/supported-services';
+
+import * as providerController from '../../provider-utils/awscloudformation/index';
+
+export const name = 'update';
+export const alias = ['update'];
+
+export const run = async (context: $TSContext) => {
+  const { amplify } = context;
+  const stateMeta = stateManager.getMeta();
+  const existingAuth = stateMeta.auth ?? {};
+  if (_.isEmpty(existingAuth)) {
+    return printer.warn('Project does not contain auth resources. Add auth using `amplify add auth`.');
+  } else {
+    const services = Object.keys(existingAuth);
+    for (const service of services) {
+      const serviceMeta = existingAuth[service];
+      if (serviceMeta.service === 'Cognito' && serviceMeta.mobileHubMigrated === true) {
+        printer.error('Auth is migrated from Mobile Hub and cannot be updated with Amplify CLI.');
+        return context;
+      } else if (serviceMeta.service === 'Cognito' && serviceMeta.serviceType === 'imported') {
+        printer.error('Updating imported Auth resource is not supported.');
+        return context;
+      }
+    }
+  }
+
+  printer.info('Please note that certain attributes may not be overwritten if you choose to use defaults settings.');
+  const dependentResources = Object.keys(stateMeta).some(e => {
+    return ['analytics', 'api', 'storage', 'function'].includes(e) && Object.keys(stateMeta[e]).length > 0;
+  });
+  if (dependentResources) {
+    printer.info(messages.dependenciesExists);
+  }
+  const resourceName = await getAuthResourceName(context);
+  await checkAuthResourceMigration(context, resourceName);
+  const cliState = new AuthInputState(resourceName);
+  context.updatingAuth = await cliState.loadResourceParameters(context, cliState.getCLIInputPayload());
+
+  try {
+    const result = await amplify.serviceSelectionPrompt(context, category, supportedServices);
+    const options = {
+      service: result.service,
+      providerPlugin: result.providerName,
+      resourceName,
+    };
+    if (!providerController) {
+      printer.error('Provider not configured for this category');
+      return;
+    }
+    const updateResourceResponse = await providerController.updateResource(context, options);
+    printer.success(`Successfully updated resource ${name} locally`);
+    printer.blankLine();
+    printer.success('Some next steps:');
+    printer.info('"amplify push" will build all your local backend resources and provision it in the cloud');
+    printer.info(
+      '"amplify publish" will build all your local backend and frontend resources (if you have hosting category added) and provision it in the cloud',
+    );
+    printer.blankLine();
+    return updateResourceResponse;
+  } catch (err) {
+    printer.info(err.stack);
+    printer.error('There was an error adding the auth resource');
+    context.usageData.emitError(err);
+    process.exitCode = 1;
+  }
+};
diff --git a/packages/amplify-category-auth/src/index.js b/packages/amplify-category-auth/src/index.js
index 60d30618107..a0109dd6bb1 100644
--- a/packages/amplify-category-auth/src/index.js
+++ b/packages/amplify-category-auth/src/index.js
@@ -1,7 +1,5 @@
 const category = 'auth';
 
-const { JSONUtilities, stateManager } = require('amplify-cli-core');
-const { validateAddAuthRequest, validateUpdateAuthRequest, validateImportAuthRequest } = require('amplify-util-headless-input');
 const _ = require('lodash');
 const path = require('path');
 const sequential = require('promise-sequential');
@@ -9,34 +7,39 @@ const sequential = require('promise-sequential');
 const defaults = require('./provider-utils/awscloudformation/assets/cognito-defaults');
 const { getAuthResourceName } = require('./utils/getAuthResourceName');
 const { updateConfigOnEnvInit, migrate } = require('./provider-utils/awscloudformation');
-const {
-  copyCfnTemplate,
-  saveResourceParameters,
-  removeDeprecatedProps,
-} = require('./provider-utils/awscloudformation/utils/synthesize-resources');
+const { removeDeprecatedProps } = require('./provider-utils/awscloudformation/utils/synthesize-resources');
 const { ENV_SPECIFIC_PARAMS } = require('./provider-utils/awscloudformation/constants');
 
 const { transformUserPoolGroupSchema } = require('./provider-utils/awscloudformation/utils/transform-user-pool-group');
 const { uploadFiles } = require('./provider-utils/awscloudformation/utils/trigger-file-uploader');
+const { validateAddAuthRequest, validateUpdateAuthRequest, validateImportAuthRequest } = require('amplify-util-headless-input');
 const { getAddAuthRequestAdaptor, getUpdateAuthRequestAdaptor } = require('./provider-utils/awscloudformation/utils/auth-request-adaptors');
 const { getAddAuthHandler, getUpdateAuthHandler } = require('./provider-utils/awscloudformation/handlers/resource-handlers');
 const { projectHasAuth } = require('./provider-utils/awscloudformation/utils/project-has-auth');
 const { attachPrevParamsToContext } = require('./provider-utils/awscloudformation/utils/attach-prev-params-to-context');
-const { getFrontendConfig } = require('./provider-utils/awscloudformation/utils/amplify-meta-updaters');
+const { stateManager, AmplifySupportedService } = require('amplify-cli-core');
 const { headlessImport } = require('./provider-utils/awscloudformation/import');
+const { getFrontendConfig } = require('./provider-utils/awscloudformation/utils/amplify-meta-updaters');
 const { AuthParameters } = require('./provider-utils/awscloudformation/import/types');
-const { getSupportedServices } = require('./provider-utils/supported-services');
+const getSupportedServices = require('./provider-utils/supported-services');
+const { generateAuthStackTemplate } = require('./provider-utils/awscloudformation/utils/generate-auth-stack-template');
+const { AmplifyAuthTransform, AmplifyUserPoolGroupTransform } = require('./provider-utils/awscloudformation/auth-stack-builder');
+const { AmplifyAuthCognitoStackTemplate } = require('./provider-utils/awscloudformation/auth-stack-builder/types');
 
 const {
   doesConfigurationIncludeSMS,
   loadResourceParameters,
   loadImportedAuthParameters,
 } = require('./provider-utils/awscloudformation/utils/auth-sms-workflow-helper');
+const { AuthInputState } = require('./provider-utils/awscloudformation/auth-inputs-manager/auth-input-state');
+const { printer } = require('amplify-prompts');
+const { checkAuthResourceMigration } = require('./provider-utils/awscloudformation/utils/migrate-override-resource');
+const { privateKeys } = require('./provider-utils/awscloudformation/constants');
 
 // this function is being kept for temporary compatability.
 async function add(context) {
   const { amplify } = context;
-  const servicesMetadata = getSupportedServices();
+  const servicesMetadata = getSupportedServices.supportedServices;
   const existingAuth = amplify.getProjectDetails().amplifyMeta.auth || {};
 
   if (Object.keys(existingAuth).length > 0) {
@@ -64,11 +67,25 @@ async function add(context) {
     });
 }
 
+async function transformCategoryStack(context, resource) {
+  if (resource.service === AmplifySupportedService.COGNITO) {
+    if (canResourceBeTransformed(resource.resourceName)) {
+      generateAuthStackTemplate(context, resource.resourceName);
+    }
+  } else if (resource.service === 'S3') {
+    // Not yet implemented
+  }
+}
+
+function canResourceBeTransformed(resourceName) {
+  const resourceInputState = new AuthInputState(resourceName);
+  return resourceInputState.cliInputFileExists();
+}
+
 async function externalAuthEnable(context, externalCategory, resourceName, requirements) {
   const { amplify } = context;
-  const serviceMetadata = getSupportedServices();
-  const { cfnFilename, provider } = serviceMetadata.Cognito;
-  const authExists = amplify.getProjectDetails().amplifyMeta.auth && Object.keys(amplify.getProjectDetails().amplifyMeta.auth).length > 0; //eslint-disable-line
+  const serviceMetadata = getSupportedServices.supportedServices;
+  const existingAuthResource = _.get(amplify.getProjectDetails().amplifyMeta, ['auth', currentAuthName], undefined);
   let currentAuthName;
   const projectName = context.amplify
     .getProjectConfig()
@@ -79,16 +96,16 @@ async function externalAuthEnable(context, externalCategory, resourceName, requi
   const immutables = {};
 
   // if auth has already been enabled, grab the existing parameters
-  if (authExists) {
-    const providerPlugin = context.amplify.getPluginInstance(context, provider);
-    currentAuthName = await getAuthResourceName(context);
-    currentAuthParams = providerPlugin.loadResourceParameters(context, 'auth', currentAuthName);
-
+  if (existingAuthResource) {
     // sanity check that it cannot happen
-    const existingAuthResource = _.get(amplify.getProjectDetails().amplifyMeta, ['auth', currentAuthName], undefined);
-    if (existingAuthResource && existingAuthResource.serviceType === 'imported') {
+    if (existingAuthResource.serviceType === 'imported') {
       throw new Error('Existing auth resource is imported and auth configuration update was requested.');
     }
+    currentAuthName = await getAuthResourceName(context);
+    // check for migration when auth has been enabled
+    checkAuthResourceMigration(context, currentAuthName);
+    const cliState = new AuthInputState(currentAuthName);
+    currentAuthParams = await cliState.loadResourceParameters(context, cliState.getCLIInputPayload());
 
     if (requirements.authSelections.includes('identityPoolOnly') && currentAuthParams.userPoolName) {
       requirements.authSelections = 'identityPoolAndUserPool';
@@ -129,11 +146,25 @@ async function externalAuthEnable(context, externalCategory, resourceName, requi
 
   try {
     authProps = await removeDeprecatedProps(authProps);
-    await copyCfnTemplate(context, category, authProps, cfnFilename);
-    await saveResourceParameters(context, provider, category, authProps.resourceName, authProps, ENV_SPECIFIC_PARAMS);
+    await generateAuthStackTemplate(context, existingAuthResource);
+    // replace secret keys from cli inputs to be stored in deployment secrets
+
+    let sharedParams = Object.assign({}, authProps);
+    privateKeys.forEach(p => delete sharedParams[p]);
+    sharedParams = removeDeprecatedProps(sharedParams);
+    // extracting env-specific params from parameters object
+    let envSpecificParams = {};
+    const cliInputs = { ...sharedParams };
+    ENV_SPECIFIC_PARAMS.forEach(paramName => {
+      if (paramName in authProps) {
+        envSpecificParams[paramName] = cliInputs[paramName];
+        delete cliInputs[paramName];
+      }
+    });
+    context.amplify.saveEnvResourceParameters(context, category, existingAuthResource, envSpecificParams);
     const resourceDirPath = path.join(amplify.pathManager.getBackendDirPath(), 'auth', authProps.resourceName, 'parameters.json');
     const authParameters = await amplify.readJsonFile(resourceDirPath);
-    if (!authExists) {
+    if (!existingAuthResource) {
       const options = {
         service: 'Cognito',
         serviceType: 'managed',
@@ -165,12 +196,12 @@ async function externalAuthEnable(context, externalCategory, resourceName, requi
       await transformUserPoolGroupSchema(context);
     }
 
-    const action = authExists ? 'updated' : 'added';
-    context.print.success(`Successfully ${action} auth resource locally.`);
+    const action = existingAuthResource ? 'updated' : 'added';
+    printer.success(`Successfully ${action} auth resource locally.`);
 
     return authProps.resourceName;
   } catch (e) {
-    context.print.error('Error updating Cognito resource');
+    printer.error('Error updating Cognito resource');
     throw e;
   }
 }
@@ -311,7 +342,6 @@ async function initEnv(context) {
 
 async function console(context) {
   const { amplify } = context;
-  const supportedServices = getSupportedServices();
   const amplifyMeta = amplify.getProjectMeta();
 
   if (!amplifyMeta.auth || Object.keys(amplifyMeta.auth).length === 0) {
@@ -319,7 +349,7 @@ async function console(context) {
   }
 
   return amplify
-    .serviceSelectionPrompt(context, category, supportedServices)
+    .serviceSelectionPrompt(context, category, getSupportedServices.supportedServices)
     .then(result => {
       const providerController = require(`${__dirname}/provider-utils/${result.providerName}/index`);
       if (!providerController) {
@@ -403,10 +433,11 @@ const executeAmplifyHeadlessCommand = async (context, headlessPayload) => {
         return;
       }
       await validateImportAuthRequest(headlessPayload);
-      const { provider } = getSupportedServices().Cognito;
+      const { provider } = getSupportedServices.supportedServices.Cognito;
       const providerPlugin = context.amplify.getPluginInstance(context, provider);
       const cognito = await providerPlugin.createCognitoUserPoolService(context);
       const identity = await providerPlugin.createIdentityPoolService(context);
+      const { JSONUtilities } = require('amplify-cli-core/lib/jsonUtilities');
       const { userPoolId, identityPoolId, nativeClientId, webClientId } = JSONUtilities.parse(headlessPayload);
       const projectConfig = context.amplify.getProjectConfig();
       const resourceName = projectConfig.projectName.toLowerCase().replace(/[^A-Za-z0-9_]+/g, '_');
@@ -433,12 +464,12 @@ async function handleAmplifyEvent(context, args) {
 }
 
 async function prePushAuthHook(context) {
-  await transformUserPoolGroupSchema(context);
+  //await transformUserPoolGroupSchema(context);
 }
 
 async function importAuth(context) {
   const { amplify } = context;
-  const servicesMetadata = getSupportedServices();
+  const servicesMetadata = getSupportedServices.supportedServices;
   const existingAuth = amplify.getProjectDetails().amplifyMeta.auth || {};
 
   if (Object.keys(existingAuth).length > 0) {
@@ -481,4 +512,9 @@ module.exports = {
   isSMSWorkflowEnabled,
   AuthParameters,
   getFrontendConfig,
+  generateAuthStackTemplate,
+  AmplifyAuthTransform,
+  AmplifyUserPoolGroupTransform,
+  transformCategoryStack,
+  AmplifyAuthCognitoStackTemplate,
 };
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/assets/cognito-defaults.js b/packages/amplify-category-auth/src/provider-utils/awscloudformation/assets/cognito-defaults.js
index e94f9450270..c0d921ca2e7 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/assets/cognito-defaults.js
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/assets/cognito-defaults.js
@@ -3,21 +3,11 @@ const { booleanOptions, oAuthScopes } = require('./string-maps');
 
 const [sharedId] = uuid().split('-');
 
-const roles = {
-  authRoleArn: {
-    'Fn::GetAtt': ['AuthRole', 'Arn'],
-  },
-  unauthRoleArn: {
-    'Fn::GetAtt': ['UnauthRole', 'Arn'],
-  },
-};
-
 const generalDefaults = projectName => ({
   sharedId,
   resourceName: `${projectName}${sharedId}`,
   resourceNameTruncated: `${projectName.substring(0, 6)}${sharedId}`,
   authSelections: 'identityPoolAndUserPool',
-  ...roles,
 });
 
 const userPoolDefaults = projectName => {
@@ -96,6 +86,5 @@ module.exports = {
   generalDefaults,
   withSocialDefaults,
   entityKeys,
-  roles,
   sharedId,
 };
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/assets/string-maps.js b/packages/amplify-category-auth/src/provider-utils/awscloudformation/assets/string-maps.js
index 87a4cde193a..5ea0390933c 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/assets/string-maps.js
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/assets/string-maps.js
@@ -116,8 +116,7 @@ const emailRegistration = [
 
 const authSelectionMap = [
   {
-    name:
-      'User Sign-Up, Sign-In, connected with AWS IAM controls (Enables per-user Storage features for images or other content, Analytics, and more)',
+    name: 'User Sign-Up, Sign-In, connected with AWS IAM controls (Enables per-user Storage features for images or other content, Analytics, and more)',
     value: 'identityPoolAndUserPool',
   },
   {
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-inputs-manager/auth-input-state.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-inputs-manager/auth-input-state.ts
new file mode 100644
index 00000000000..fcaae0db7ce
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-inputs-manager/auth-input-state.ts
@@ -0,0 +1,98 @@
+import * as fs from 'fs-extra';
+import * as path from 'path';
+import {
+  AmplifyCategories,
+  AmplifySupportedService,
+  JSONUtilities,
+  pathManager,
+  CLIInputSchemaValidator,
+  CategoryInputState,
+  FeatureFlags,
+  $TSContext,
+} from 'amplify-cli-core';
+import { CognitoCLIInputs } from '../service-walkthrough-types/awsCognito-user-input-types';
+import { CognitoStackOptions } from '../service-walkthrough-types/cognito-user-input-types';
+import _ from 'lodash';
+
+export class AuthInputState extends CategoryInputState {
+  #cliInputsFilePath: string; //cli-inputs.json (output) filepath
+  #resourceName: string; //user friendly name provided by user
+  #category: string; //category of the resource
+  #service: string; //AWS service for the resource
+  #buildFilePath: string;
+
+  constructor(resourceName: string) {
+    super(resourceName);
+    this.#category = AmplifyCategories.AUTH;
+    this.#service = AmplifySupportedService.COGNITO;
+    this.#resourceName = resourceName;
+
+    const projectBackendDirPath = pathManager.getBackendDirPath();
+    this.#cliInputsFilePath = path.resolve(path.join(projectBackendDirPath, AmplifyCategories.AUTH, resourceName, 'cli-inputs.json'));
+    this.#buildFilePath = path.resolve(path.join(projectBackendDirPath, AmplifyCategories.AUTH, resourceName, 'build'));
+  }
+
+  public async isCLIInputsValid(cliInputs: CognitoCLIInputs = this.getCLIInputPayload()): Promise<boolean> {
+    const schemaValidator = new CLIInputSchemaValidator('awsCognito', this.#category, 'CognitoCLIInputs');
+    return schemaValidator.validateInput(JSON.stringify(cliInputs));
+  }
+
+  public getCLIInputPayload(): CognitoCLIInputs {
+    return JSONUtilities.readJson<CognitoCLIInputs>(this.#cliInputsFilePath, { throwIfNotExist: true })!;
+  }
+
+  public cliInputFileExists(): boolean {
+    return fs.existsSync(this.#cliInputsFilePath);
+  }
+
+  public async saveCLIInputPayload(cliInputs: CognitoCLIInputs): Promise<void> {
+    if (await this.isCLIInputsValid(cliInputs)) {
+      fs.ensureDirSync(path.join(pathManager.getBackendDirPath(), this.#category, this._resourceName));
+      JSONUtilities.writeJson(this.#cliInputsFilePath, cliInputs);
+    }
+  }
+
+  /**
+   *
+   * @param context Converts cli-inputs.json to CognitoStackParameters
+   * @param cliInputs auth resource state
+   * @returns previously selected cli-inputs
+   */
+
+  public async loadResourceParameters(context: $TSContext, cliInputs: CognitoCLIInputs): Promise<CognitoStackOptions> {
+    const roles = {
+      authRoleArn: {
+        'Fn::GetAtt': ['AuthRole', 'Arn'],
+      },
+      unauthRoleArn: {
+        'Fn::GetAtt': ['UnauthRole', 'Arn'],
+      },
+    };
+
+    let parameters: CognitoStackOptions = {
+      ...cliInputs.cognitoConfig,
+      ...roles,
+      breakCircularDependency: FeatureFlags.getBoolean('auth.breakcirculardependency'),
+      dependsOn: [],
+    };
+
+    // determine permissions needed for each trigger module
+    if (!_.isEmpty(parameters.triggers)) {
+      parameters.triggers = JSON.stringify(parameters.triggers);
+      // convert dependsOn
+      let dependsOn;
+      if (parameters.dependsOn && !_.isEmpty(parameters.dependsOn)) {
+        dependsOn = parameters.dependsOn;
+      } else {
+        // generate dependsOn from cli-inputs
+        const dependsOnKeys = Object.keys(parameters.triggers).map(i => `${parameters.resourceName}${i}`);
+        dependsOn = context.amplify.dependsOnBlock(context, dependsOnKeys, 'Cognito');
+      }
+      parameters = Object.assign(parameters, {
+        triggers: parameters.triggers,
+        dependsOn,
+      });
+    }
+    return parameters;
+  }
+}
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/auth-cognito-stack-builder.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/auth-cognito-stack-builder.ts
new file mode 100644
index 00000000000..af4819fe9da
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/auth-cognito-stack-builder.ts
@@ -0,0 +1,1148 @@
+import * as cdk from '@aws-cdk/core';
+import * as s3 from '@aws-cdk/aws-s3';
+import * as iam from '@aws-cdk/aws-iam';
+import * as cognito from '@aws-cdk/aws-cognito';
+import * as lambda from '@aws-cdk/aws-lambda';
+import { AmplifyAuthCognitoStackTemplate } from './types';
+import { CognitoStackOptions } from '../service-walkthrough-types/cognito-user-input-types';
+import _ from 'lodash';
+import {
+  hostedUILambdaFilePath,
+  hostedUIProviderLambdaFilePath,
+  mfaLambdaFilePath,
+  oauthLambdaFilePath,
+  openIdLambdaFilePath,
+  userPoolClientLambdaFilePath,
+} from '../constants';
+import * as fs from 'fs-extra';
+import { AmplifyStackTemplate } from 'amplify-cli-core';
+
+const CFN_TEMPLATE_FORMAT_VERSION = '2010-09-09';
+const ROOT_CFN_DESCRIPTION = 'Amplify Cognito Stack for AWS Amplify CLI';
+
+const LambdaTriggersKeys = [
+  'CreateAuthChallenge',
+  'CustomMessage',
+  'DefineAuthChallenge',
+  'PostAuthentication',
+  'PostConfirmation',
+  'PreAuthentication',
+  'PreSignUp',
+  'PreTokenGeneration',
+  'VerifyAuthChallengeResponse',
+];
+
+const authProvidersList: Record<string, string> = {
+  'graph.facebook.com': 'facebookAppId',
+  'accounts.google.com': 'googleClientId',
+  'www.amazon.com': 'amazonAppId',
+  'appleid.apple.com': 'appleAppId',
+};
+
+export type AmplifyAuthCognitoStackProps = {
+  synthesizer: cdk.IStackSynthesizer;
+};
+
+export class AmplifyAuthCognitoStack extends cdk.Stack implements AmplifyAuthCognitoStackTemplate, AmplifyStackTemplate {
+  private _scope: cdk.Construct;
+  private _cfnParameterMap: Map<string, cdk.CfnParameter> = new Map();
+  private _cfnConditionMap: Map<string, cdk.CfnCondition> = new Map();
+  private _cfnOutputMap: Map<string, cdk.CfnOutput> = new Map();
+  private _cfnMappingMap: Map<string, cdk.CfnMapping> = new Map();
+  customMessageConfirmationBucket?: s3.CfnBucket;
+  snsRole: iam.CfnRole | undefined;
+  userPool: cognito.CfnUserPool | undefined;
+  userPoolClientWeb: cognito.CfnUserPoolClient | undefined;
+  userPoolClient: cognito.CfnUserPoolClient | undefined;
+  identityPool: cognito.CfnIdentityPool | undefined;
+  identityPoolRoleMap: cognito.CfnIdentityPoolRoleAttachment | undefined;
+  lambdaConfigPermissions?: Record<string, lambda.CfnPermission>;
+  lambdaTriggerPermissions?: Record<string, iam.CfnPolicy>;
+  // customresources userPoolClient
+  userPoolClientLambda?: lambda.CfnFunction;
+  userPoolClientRole?: iam.CfnRole;
+  userPoolClientLambdaPolicy?: iam.CfnPolicy;
+  userPoolClientLogPolicy?: iam.CfnPolicy;
+  userPoolClientInputs?: cdk.CustomResource;
+  // customresources HostedUI
+  hostedUICustomResource?: lambda.CfnFunction;
+  hostedUICustomResourcePolicy?: iam.CfnPolicy;
+  hostedUICustomResourceLogPolicy?: iam.CfnPolicy;
+  hostedUICustomResourceInputs?: cdk.CustomResource;
+  // custom resource HostedUI Provider
+  hostedUIProvidersCustomResource?: lambda.CfnFunction;
+  hostedUIProvidersCustomResourcePolicy?: iam.CfnPolicy;
+  hostedUIProvidersCustomResourceLogPolicy?: iam.CfnPolicy;
+  hostedUIProvidersCustomResourceInputs?: cdk.CustomResource;
+  // custom resource OAUTH Provider
+  oAuthCustomResource?: lambda.CfnFunction;
+  oAuthCustomResourcePolicy?: iam.CfnPolicy;
+  oAuthCustomResourceLogPolicy?: iam.CfnPolicy;
+  oAuthCustomResourceInputs?: cdk.CustomResource;
+  //custom resource MFA
+  mfaLambda?: lambda.CfnFunction;
+  mfaLogPolicy?: iam.CfnPolicy;
+  mfaLambdaPolicy?: iam.CfnPolicy;
+  mfaLambdaInputs?: cdk.CustomResource;
+  mfaLambdaRole?: iam.CfnRole;
+
+  //custom resource identity pool - OPenId Lambda Role
+  openIdLambda?: lambda.CfnFunction;
+  openIdLogPolicy?: iam.CfnPolicy;
+  openIdLambdaIAMPolicy?: iam.CfnPolicy;
+  openIdLambdaInputs?: cdk.CustomResource;
+  openIdLambdaRole?: iam.CfnRole;
+
+  constructor(scope: cdk.Construct, id: string, props: AmplifyAuthCognitoStackProps) {
+    super(scope, id, props);
+    this._scope = scope;
+    this.templateOptions.templateFormatVersion = CFN_TEMPLATE_FORMAT_VERSION;
+    this.templateOptions.description = ROOT_CFN_DESCRIPTION;
+    this.lambdaConfigPermissions = {};
+    this.lambdaTriggerPermissions = {};
+  }
+  addCfnResource(props: cdk.CfnResourceProps, logicalId: string): void {
+    throw new Error('Method not implemented.');
+  }
+  getCfnOutput(logicalId: string): cdk.CfnOutput {
+    throw new Error('Method not implemented.');
+  }
+  getCfnMapping(logicalId: string): cdk.CfnMapping {
+    throw new Error('Method not implemented.');
+  }
+
+  /**
+   *
+   * @param props :cdk.CfnOutputProps
+   * @param logicalId: : lodicalId of the Resource
+   */
+  addCfnOutput(props: cdk.CfnOutputProps, logicalId: string): void {
+    if (!this._cfnOutputMap.has(logicalId)) {
+      this._cfnOutputMap.set(logicalId, new cdk.CfnOutput(this, logicalId, props));
+    } else {
+      throw new Error(`Cfn Parameter with LogicalId ${logicalId} doesnt exist`);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnMapping(props: cdk.CfnMappingProps, logicalId: string): void {
+    if (!this._cfnMappingMap.has(logicalId)) {
+      this._cfnMappingMap.set(logicalId, new cdk.CfnMapping(this, logicalId, props));
+    } else {
+      throw new Error(`Cfn Parameter with LogicalId ${logicalId} doesnt exist`);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnCondition(props: cdk.CfnConditionProps, logicalId: string): void {
+    if (!this._cfnConditionMap.has(logicalId)) {
+      this._cfnConditionMap.set(logicalId, new cdk.CfnCondition(this, logicalId, props));
+    } else {
+      throw new Error(`Cfn Parameter with LogicalId ${logicalId} doesnt exist`);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnParameter(props: cdk.CfnParameterProps, logicalId: string): void {
+    if (!this._cfnParameterMap.has(logicalId)) {
+      this._cfnParameterMap.set(logicalId, new cdk.CfnParameter(this, logicalId, props));
+    } else {
+      throw new Error(`Cfn Parameter with LogicalId ${logicalId} doesnt exist`);
+    }
+  }
+
+  getCfnParameter(logicalId: string): cdk.CfnParameter {
+    if (this._cfnParameterMap.has(logicalId)) {
+      return this._cfnParameterMap.get(logicalId)!;
+    } else {
+      throw new Error(`Cfn Parameter with LogicalId ${logicalId} doesnt exist`);
+    }
+  }
+
+  getCfnCondition(logicalId: string): cdk.CfnCondition {
+    if (this._cfnConditionMap.has(logicalId)) {
+      return this._cfnConditionMap.get(logicalId)!;
+    } else {
+      throw new Error(`Cfn Condition with LogicalId ${logicalId} doesnt exist`);
+    }
+  }
+
+  generateCognitoStackResources = async (props: CognitoStackOptions) => {
+    if (props.verificationBucketName) {
+      this.customMessageConfirmationBucket = new s3.CfnBucket(this, 'CustomMessageConfirmationBucket', {
+        bucketName: cdk.Fn.conditionIf(
+          'ShouldNotCreateEnvResources',
+          cdk.Fn.ref('verificationBucketName'),
+          cdk.Fn.join('-', [cdk.Fn.ref('verificationBucketName'), cdk.Fn.ref('env')]),
+        ).toString(),
+        accessControl: s3.BucketAccessControl.PRIVATE,
+        corsConfiguration: {
+          corsRules: [
+            {
+              allowedHeaders: ['Authorization', 'Content-length'],
+              allowedMethods: ['GET'],
+              allowedOrigins: ['*'],
+              maxAge: 3000,
+            },
+          ],
+        },
+      });
+      this.customMessageConfirmationBucket.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN);
+    }
+
+    if (props.authSelections !== 'identityPoolOnly') {
+      this.snsRole = new iam.CfnRole(this, 'SNSRole', {
+        roleName: cdk.Fn.conditionIf(
+          'ShouldNotCreateEnvResources',
+          `${props.resourceNameTruncated}_sns-role`,
+          cdk.Fn.join('', [
+            'sns',
+            `${props.sharedId}`,
+            cdk.Fn.select(3, cdk.Fn.split('-', cdk.Fn.ref('AWS::StackName'))),
+            '-',
+            cdk.Fn.ref('env'),
+          ]),
+        ).toString(),
+        assumeRolePolicyDocument: {
+          Version: '2012-10-17',
+          Statement: [
+            {
+              Sid: '',
+              Effect: 'Allow',
+              Principal: {
+                Service: 'cognito-idp.amazonaws.com',
+              },
+              Action: ['sts:AssumeRole'],
+              Condition: {
+                StringEquals: {
+                  'sts:ExternalId': `${props.resourceNameTruncated}_role_external_id`,
+                },
+              },
+            },
+          ],
+        },
+        policies: [
+          {
+            policyName: `${props.resourceNameTruncated}-sns-policy`,
+            policyDocument: {
+              Version: '2012-10-17',
+              Statement: [
+                {
+                  Effect: 'Allow',
+                  Action: ['sns:Publish'],
+                  Resource: '*',
+                },
+              ],
+            },
+          },
+        ],
+      });
+
+      this.userPool = new cognito.CfnUserPool(this, 'UserPool', {
+        userPoolName: cdk.Fn.conditionIf(
+          'ShouldNotCreateEnvResources',
+          cdk.Fn.ref('userPoolName'),
+          cdk.Fn.join('', [cdk.Fn.ref('userPoolName'), '-', cdk.Fn.ref('env')]),
+        ).toString(),
+        policies: {
+          passwordPolicy: {
+            minimumLength: cdk.Fn.ref('passwordPolicyMinLength') as unknown as number,
+            requireLowercase: props.passwordPolicyCharacters!.includes('Requires Lowercase'),
+            requireNumbers: props.passwordPolicyCharacters!.includes('Requires Numbers'),
+            requireSymbols: props.passwordPolicyCharacters!.includes('Requires Symbols'),
+            requireUppercase: props.passwordPolicyCharacters!.includes('Requires Uppercase'),
+          },
+        },
+      });
+
+      this.userPool.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN);
+
+      if (props.requiredAttributes && props.requiredAttributes.length > 0) {
+        if (props.usernameCaseSensitive !== undefined) {
+          this.userPool.usernameConfiguration = {
+            caseSensitive: props.usernameCaseSensitive,
+          };
+        }
+        props.requiredAttributes.forEach(attr => {
+          this.userPool!.schema = [
+            {
+              name: attr,
+              required: true,
+              mutable: true,
+            },
+          ];
+        });
+      }
+      if (!props.breakCircularDependency && props.triggers && props.dependsOn) {
+        let lambdaConfigProp: { [x: string]: string } = {};
+        props.dependsOn!.forEach(trigger => {
+          LambdaTriggersKeys.forEach(key => {
+            if (trigger.resourceName.includes(key)) {
+              lambdaConfigProp[key] = cdk.Fn.ref(`${props.resourceName}${key}Arn`);
+            }
+          });
+        });
+        this.userPool.lambdaConfig = cdk.Lazy.anyValue({
+          produce: () => {
+            return lambdaConfigProp;
+          },
+        });
+      }
+
+      if (props.autoVerifiedAttributes && props.autoVerifiedAttributes.length > 0) {
+        this.userPool!.autoVerifiedAttributes = props.autoVerifiedAttributes;
+      }
+
+      if (props.autoVerifiedAttributes.includes('email')) {
+        this.userPool.emailVerificationMessage = cdk.Fn.ref('emailVerificationMessage');
+        this.userPool.emailVerificationSubject = cdk.Fn.ref('emailVerificationSubject');
+      }
+
+      //TODO: change this
+      if (props.usernameAttributes && (props.usernameAttributes[0] as string) !== 'username') {
+        this.userPool.usernameAttributes = cdk.Fn.ref('usernameAttributes') as unknown as string[];
+      }
+      // alias attributes
+      if (props.aliasAttributes && props.aliasAttributes.length > 0) {
+        this.userPool.aliasAttributes = cdk.Fn.ref('aliasAttributes') as unknown as string[];
+      }
+      this.userPool.mfaConfiguration = cdk.Fn.ref('mfaConfiguration');
+
+      this.userPool.smsVerificationMessage = cdk.Fn.ref('smsVerificationMessage');
+      this.userPool.smsAuthenticationMessage = cdk.Fn.ref('smsAuthenticationMessage');
+
+      this.userPool.smsConfiguration = {
+        externalId: `${props.resourceNameTruncated}_role_external_id`,
+        snsCallerArn: cdk.Fn.getAtt('SNSRole', 'Arn').toString(),
+      };
+
+      if (props.mfaConfiguration != 'OFF') {
+        this.userPool.addDependsOn(this.snsRole);
+      }
+
+      this.userPool.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN, {
+        applyToUpdateReplacePolicy: true,
+        default: cdk.RemovalPolicy.RETAIN,
+      });
+
+      // updating Lambda Config when FF is (breakcirculardependency : false)
+
+      if (!props.breakCircularDependency && props.triggers && props.dependsOn) {
+        props.dependsOn.forEach(trigger => {
+          LambdaTriggersKeys.forEach(key => {
+            if (trigger.resourceName.includes(key)) {
+              const resourceKey = `UserPool${key}LambdaInvokePermission`;
+              this.lambdaConfigPermissions![`${resourceKey}`] = new lambda.CfnPermission(this, `${resourceKey}`, {
+                action: 'lambda:invokeFunction',
+                principal: 'cognito-idp.amazonaws.com',
+                functionName: cdk.Fn.ref(`${props.resourceName}${key}`),
+                sourceArn: cdk.Fn.getAtt('Userpool', 'Arn').toString(),
+              });
+            }
+          });
+        });
+        //Updating lambda role with permissions to Cognito
+        if (!_.isEmpty(props.permissions)) {
+          this.generateIAMPolicies(props);
+        }
+      }
+      /**
+       *   # Created provide application access to user pool
+            # Depends on UserPool for ID reference
+       */
+      this.userPoolClientWeb = new cognito.CfnUserPoolClient(this, 'UserPoolClientWeb', {
+        userPoolId: cdk.Fn.ref('UserPool'),
+        clientName: `${props.resourceNameTruncated}_app_clientWeb`,
+      });
+      if (props.userpoolClientSetAttributes) {
+        this.userPoolClientWeb.readAttributes = this._cfnParameterMap.get('userpoolClientReadAttributes')?.valueAsList;
+        this.userPoolClientWeb.writeAttributes = this._cfnParameterMap.get('userpoolClientWriteAttributes')?.valueAsList;
+      }
+      this.userPoolClientWeb.refreshTokenValidity = cdk.Fn.ref('userpoolClientRefreshTokenValidity') as unknown as number;
+      this.userPoolClientWeb.addDependsOn(this.userPool);
+
+      this.userPoolClient = new cognito.CfnUserPoolClient(this, 'UserPoolClient', {
+        userPoolId: cdk.Fn.ref('UserPool'),
+        clientName: `${props.resourceNameTruncated}_app_client`,
+      });
+      if (props.userpoolClientSetAttributes) {
+        this.userPoolClient.readAttributes = this._cfnParameterMap.get('userpoolClientReadAttributes')?.valueAsList;
+        this.userPoolClient.writeAttributes = this._cfnParameterMap.get('userpoolClientWriteAttributes')?.valueAsList;
+      }
+      this.userPoolClient.refreshTokenValidity = cdk.Fn.ref('userpoolClientRefreshTokenValidity') as unknown as number;
+      this.userPoolClient.generateSecret = cdk.Fn.ref('userpoolClientGenerateSecret') as unknown as boolean;
+      this.userPoolClient.addDependsOn(this.userPool);
+
+      this.createUserPoolClientCustomResource(props);
+      if (props.hostedUIDomainName) {
+        this.createHostedUICustomResource(props);
+      }
+      if (props.hostedUIProviderMeta) {
+        this.createHostedUIProviderCustomResource(props);
+      }
+      if (props.oAuthMetadata) {
+        this.createOAuthCustomResource(props);
+      }
+      if (props.mfaConfiguration != 'OFF') {
+        this.createMFACustomResource(props);
+      }
+    }
+    // Begin IdentityPool Resources
+    if (props.authSelections === 'identityPoolAndUserPool' || props.authSelections === 'identityPoolOnly') {
+      if (props.audiences && props.audiences.length > 0) {
+        this.createOpenIdLambdaCustomResource(props);
+      }
+
+      this.identityPool = new cognito.CfnIdentityPool(this, 'IdentityPool', {
+        identityPoolName: cdk.Fn.conditionIf(
+          'ShouldNotCreateEnvResources',
+          props.identityPoolName,
+          cdk.Fn.join('', [`${props.identityPoolName}`, '-', cdk.Fn.ref('env')]),
+        ).toString(),
+        allowUnauthenticatedIdentities: cdk.Fn.ref('allowUnauthenticatedIdentities') as unknown as boolean,
+      });
+      if (props.authSelections !== 'identityPoolOnly') {
+        this.identityPool.cognitoIdentityProviders = [
+          {
+            clientId: cdk.Fn.ref('UserPoolClient'),
+            providerName: cdk.Fn.sub('cognito-idp.${region}.amazonaws.com/${client}', {
+              region: cdk.Fn.ref('AWS::Region'),
+              client: cdk.Fn.ref('UserPool'),
+            }),
+          },
+          {
+            clientId: cdk.Fn.ref('UserPoolClientWeb'),
+            providerName: cdk.Fn.sub('cognito-idp.${region}.amazonaws.com/${client}', {
+              region: cdk.Fn.ref('AWS::Region'),
+              client: cdk.Fn.ref('UserPool'),
+            }),
+          },
+        ];
+      }
+
+      if (
+        props.authProviders &&
+        !_.isEmpty(props.authProviders) &&
+        !(Object.keys(props.authProviders).length === 1 && props.authProviders[0] === 'accounts.google.com' && props.audiences)
+      ) {
+        this.identityPool.supportedLoginProviders = cdk.Lazy.anyValue({
+          produce: () => {
+            let supprtedProvider: any = {};
+            props.authProviders?.forEach(provider => {
+              if (Object.keys(authProvidersList).includes(provider)) {
+                supprtedProvider[provider] = cdk.Fn.ref(authProvidersList[provider]);
+              }
+            });
+            return supprtedProvider;
+          },
+        });
+      }
+      if (props.audiences && props.audiences.length > 0) {
+        this.identityPool.openIdConnectProviderArns = cdk.Fn.getAtt('OpenIdLambdaInputs', 'providerArn') as unknown as string[];
+        this.identityPool.node.addDependency(this.openIdLambdaInputs!.node!.defaultChild!);
+      }
+
+      if ((!props.audiences || props.audiences.length === 0) && props.authSelections !== 'identityPoolOnly') {
+        this.identityPool.node.addDependency(this.userPoolClientInputs!.node!.defaultChild!);
+      }
+      /**
+       *  # Created to map Auth and Unauth roles to the identity pool
+          # Depends on Identity Pool for ID ref
+       */
+      this.identityPoolRoleMap = new cognito.CfnIdentityPoolRoleAttachment(this, 'IdentityPoolRoleMap', {
+        identityPoolId: cdk.Fn.ref('IdentityPool'),
+        roles: {
+          unauthenticated: cdk.Fn.ref('unauthRoleArn'),
+          authenticated: cdk.Fn.ref('authRoleArn'),
+        },
+      });
+      this.identityPoolRoleMap.addDependsOn(this.identityPool);
+    }
+  };
+
+  // add Function for Custom Resource in Root stack
+  /**
+   *
+   * @param _
+   * @returns
+   */
+  public renderCloudFormationTemplate = (_: cdk.ISynthesisSession): string => {
+    return JSON.stringify(this._toCloudFormation(), undefined, 2);
+  };
+
+  createUserPoolClientCustomResource(props: CognitoStackOptions) {
+    // iam role
+    this.userPoolClientRole = new iam.CfnRole(this, 'UserPoolClientRole', {
+      roleName: cdk.Fn.conditionIf(
+        'ShouldNotCreateEnvResources',
+        cdk.Fn.ref('userpoolClientLambdaRole'),
+        cdk.Fn.join('', [
+          'upClientLambdaRole',
+          `${props.sharedId}`,
+          cdk.Fn.select(3, cdk.Fn.split('-', cdk.Fn.ref('AWS::StackName'))),
+          '-',
+          cdk.Fn.ref('env'),
+        ]),
+      ).toString(),
+      assumeRolePolicyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Principal: {
+              Service: 'lambda.amazonaws.com',
+            },
+            Action: 'sts:AssumeRole',
+          },
+        ],
+      },
+    });
+    this.userPoolClientRole.addDependsOn(this.userPoolClient!);
+
+    // lambda function
+    this.userPoolClientLambda = new lambda.CfnFunction(this, 'UserPoolClientLambda', {
+      code: {
+        zipFile: fs.readFileSync(userPoolClientLambdaFilePath, 'utf-8'),
+      },
+      handler: 'index.handler',
+      role: cdk.Fn.getAtt('UserPoolClientRole', 'Arn').toString(),
+      runtime: 'nodejs12.x',
+      timeout: 300,
+    });
+    this.userPoolClientLambda.addDependsOn(this.userPoolClientRole);
+
+    // userPool client lambda policy
+    /**
+     *   # Sets userpool policy for the role that executes the Userpool Client Lambda
+        # Depends on UserPool for Arn
+        # Marked as depending on UserPoolClientRole for easier to understand CFN sequencing
+     */
+    this.userPoolClientLambdaPolicy = new iam.CfnPolicy(this, 'UserPoolClientLambdaPolicy', {
+      policyName: `${props.resourceNameTruncated}_userpoolclient_lambda_iam_policy`,
+      policyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: ['cognito-idp:DescribeUserPoolClient'],
+            Resource: cdk.Fn.getAtt('UserPool', 'Arn'),
+          },
+        ],
+      },
+      roles: [cdk.Fn.ref('UserPoolClientRole')],
+    });
+    this.userPoolClientLambdaPolicy.addDependsOn(this.userPoolClientLambda);
+
+    // userPool Client Log policy
+
+    this.userPoolClientLogPolicy = new iam.CfnPolicy(this, 'UserPoolClientLogPolicy', {
+      policyName: `${props.resourceNameTruncated}_userpoolclient_lambda_log_policy`,
+      policyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
+            Resource: cdk.Fn.sub('arn:aws:logs:${region}:${account}:log-group:/aws/lambda/${lambda}:log-stream:*', {
+              region: cdk.Fn.ref('AWS::Region'),
+              account: cdk.Fn.ref('AWS::AccountId'),
+              lambda: cdk.Fn.ref('UserPoolClientLambda'),
+            }),
+          },
+        ],
+      },
+      roles: [cdk.Fn.ref('UserPoolClientRole')],
+    });
+    this.userPoolClientLogPolicy.addDependsOn(this.userPoolClientLambdaPolicy);
+
+    // userPoolClient Custom Resource
+    this.userPoolClientInputs = new cdk.CustomResource(this, 'UserPoolClientInputs', {
+      serviceToken: this.userPoolClientLambda.attrArn,
+      resourceType: 'Custom::LambdaCallout',
+      properties: {
+        clientId: cdk.Fn.ref('UserPoolClient'),
+        userpoolId: cdk.Fn.ref('UserPool'),
+      },
+    });
+    this.userPoolClientInputs.node.addDependency(this.userPoolClientLogPolicy);
+  }
+
+  createHostedUICustomResource(props: CognitoStackOptions) {
+    // lambda function
+    this.hostedUICustomResource = new lambda.CfnFunction(this, 'HostedUICustomResource', {
+      code: {
+        zipFile: fs.readFileSync(hostedUILambdaFilePath, 'utf-8'),
+      },
+      handler: 'index.handler',
+      role: cdk.Fn.getAtt('UserPoolClientRole', 'Arn').toString(),
+      runtime: 'nodejs12.x',
+      timeout: 300,
+    });
+    this.hostedUICustomResource.addDependsOn(this.userPoolClientRole!);
+
+    // userPool client lambda policy
+    /**
+     *   # Sets userpool policy for the role that executes the Userpool Client Lambda
+        # Depends on UserPool for Arn
+        # Marked as depending on UserPoolClientRole for easier to understand CFN sequencing
+     */
+    this.hostedUICustomResourcePolicy = new iam.CfnPolicy(this, 'HostedUICustomResourcePolicy', {
+      policyName: cdk.Fn.join('-', [cdk.Fn.ref('UserPool'), cdk.Fn.ref('hostedUI')]),
+      policyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: ['cognito-idp:CreateUserPoolDomain', 'cognito-idp:DescribeUserPool', 'cognito-idp:DeleteUserPoolDomain'],
+            Resource: cdk.Fn.getAtt('UserPool', 'Arn'),
+          },
+          {
+            Effect: 'Allow',
+            Action: ['cognito-idp:DescribeUserPoolDomain'],
+            Resource: '*',
+          },
+        ],
+      },
+      roles: [cdk.Fn.ref('UserPoolClientRole')],
+    });
+    this.hostedUICustomResourcePolicy.addDependsOn(this.hostedUICustomResource);
+
+    // userPool Client Log policy
+
+    this.hostedUICustomResourceLogPolicy = new iam.CfnPolicy(this, 'HostedUICustomResourceLogPolicy', {
+      policyName: cdk.Fn.join('-', [cdk.Fn.ref('UserPool'), 'hostedUILogPolicy']),
+      policyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
+            Resource: cdk.Fn.sub('arn:aws:logs:${region}:${account}:log-group:/aws/lambda/${lambda}:log-stream:*', {
+              region: cdk.Fn.ref('AWS::Region'),
+              account: cdk.Fn.ref('AWS::AccountId'),
+              lambda: cdk.Fn.ref('HostedUICustomResource'),
+            }),
+          },
+        ],
+      },
+      roles: [cdk.Fn.ref('UserPoolClientRole')],
+    });
+    this.hostedUICustomResourceLogPolicy.addDependsOn(this.hostedUICustomResourcePolicy);
+
+    // userPoolClient Custom Resource
+    this.hostedUICustomResourceInputs = new cdk.CustomResource(this, 'HostedUICustomResourceInputs', {
+      serviceToken: this.hostedUICustomResource.attrArn,
+      resourceType: 'Custom::LambdaCallout',
+      properties: {
+        hostedUIDomainName: cdk.Fn.conditionIf(
+          'ShouldNotCreateEnvResources',
+          cdk.Fn.ref('hostedUIDomainName'),
+          cdk.Fn.join('-', [cdk.Fn.ref('hostedUIDomainName'), cdk.Fn.ref('env')]),
+        ),
+        userPoolId: cdk.Fn.ref('UserPool'),
+      },
+    });
+    this.hostedUICustomResourceInputs.node.addDependency(this.hostedUICustomResourceLogPolicy);
+  }
+
+  createHostedUIProviderCustomResource(props: CognitoStackOptions) {
+    // lambda function
+    this.hostedUIProvidersCustomResource = new lambda.CfnFunction(this, 'HostedUIProvidersCustomResource', {
+      code: {
+        zipFile: fs.readFileSync(hostedUIProviderLambdaFilePath, 'utf-8'),
+      },
+      handler: 'index.handler',
+      role: cdk.Fn.getAtt('UserPoolClientRole', 'Arn').toString(),
+      runtime: 'nodejs12.x',
+      timeout: 300,
+    });
+    this.hostedUIProvidersCustomResource.addDependsOn(this.userPoolClientRole!);
+
+    // userPool client lambda policy
+    /**
+     *   # Sets userpool policy for the role that executes the Userpool Client Lambda
+        # Depends on UserPool for Arn
+        # Marked as depending on UserPoolClientRole for easier to understand CFN sequencing
+     */
+    this.hostedUIProvidersCustomResourcePolicy = new iam.CfnPolicy(this, 'HostedUIProvidersCustomResourcePolicy', {
+      policyName: cdk.Fn.join('-', [cdk.Fn.ref('UserPool'), 'hostedUIProvider']),
+      policyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: [
+              'cognito-idp:CreateIdentityProvider',
+              'cognito-idp:UpdateIdentityProvider',
+              'cognito-idp:ListIdentityProviders',
+              'cognito-idp:DeleteIdentityProvider',
+            ],
+            Resource: cdk.Fn.getAtt('UserPool', 'Arn'),
+          },
+          {
+            Effect: 'Allow',
+            Action: ['cognito-idp:DescribeUserPoolDomain'],
+            Resource: '*',
+          },
+        ],
+      },
+      roles: [cdk.Fn.ref('UserPoolClientRole')],
+    });
+    this.hostedUIProvidersCustomResourcePolicy.addDependsOn(this.hostedUIProvidersCustomResource);
+
+    // userPool Client Log policy
+
+    this.hostedUIProvidersCustomResourceLogPolicy = new iam.CfnPolicy(this, 'HostedUIProvidersCustomResourceLogPolicy', {
+      policyName: cdk.Fn.join('-', [cdk.Fn.ref('UserPool'), 'hostedUIProviderLogPolicy']),
+      policyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
+            Resource: cdk.Fn.sub('arn:aws:logs:${region}:${account}:log-group:/aws/lambda/${lambda}:log-stream:*', {
+              region: cdk.Fn.ref('AWS::Region'),
+              account: cdk.Fn.ref('AWS::AccountId'),
+              lambda: cdk.Fn.ref('HostedUIProvidersCustomResource'),
+            }),
+          },
+        ],
+      },
+      roles: [cdk.Fn.ref('UserPoolClientRole')],
+    });
+    this.hostedUIProvidersCustomResourceLogPolicy.addDependsOn(this.hostedUIProvidersCustomResourcePolicy);
+
+    // userPoolClient Custom Resource
+    this.hostedUIProvidersCustomResourceInputs = new cdk.CustomResource(this, 'HostedUIProvidersCustomResourceInputs', {
+      serviceToken: this.hostedUIProvidersCustomResource.attrArn,
+      resourceType: 'Custom::LambdaCallout',
+      properties: {
+        hostedUIProviderMeta: cdk.Fn.ref('hostedUIProviderMeta'),
+        hostedUIProviderCreds: cdk.Fn.ref('hostedUIProviderCreds'),
+        userPoolId: cdk.Fn.ref('UserPool'),
+      },
+    });
+    this.hostedUIProvidersCustomResourceInputs.node.addDependency(this.hostedUIProvidersCustomResourceLogPolicy);
+  }
+
+  createOAuthCustomResource(props: CognitoStackOptions) {
+    // lambda function
+    this.oAuthCustomResource = new lambda.CfnFunction(this, 'OAuthCustomResource', {
+      code: {
+        zipFile: fs.readFileSync(oauthLambdaFilePath, 'utf-8'),
+      },
+      handler: 'index.handler',
+      role: cdk.Fn.getAtt('UserPoolClientRole', 'Arn').toString(),
+      runtime: 'nodejs12.x',
+      timeout: 300,
+    });
+    //TODO
+    this.oAuthCustomResource.node.addDependency(this.hostedUICustomResourceInputs!.node!.defaultChild!);
+
+    // userPool client lambda policy
+    /**
+     *   # Sets userpool policy for the role that executes the Userpool Client Lambda
+        # Depends on UserPool for Arn
+        # Marked as depending on UserPoolClientRole for easier to understand CFN sequencing
+     */
+    this.oAuthCustomResourcePolicy = new iam.CfnPolicy(this, 'OAuthCustomResourcePolicy', {
+      policyName: cdk.Fn.join('-', [cdk.Fn.ref('UserPool'), 'OAuth']),
+      policyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: ['cognito-idp:UpdateUserPoolClient'],
+            Resource: cdk.Fn.getAtt('UserPool', 'Arn'),
+          },
+        ],
+      },
+      roles: [cdk.Fn.ref('UserPoolClientRole')],
+    });
+    this.oAuthCustomResourcePolicy.addDependsOn(this.oAuthCustomResource);
+
+    // Oauth Log policy
+
+    this.oAuthCustomResourceLogPolicy = new iam.CfnPolicy(this, 'OAuthCustomResourceLogPolicy', {
+      policyName: cdk.Fn.join('-', [cdk.Fn.ref('UserPool'), 'OAuthLogPolicy']),
+      policyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
+            Resource: cdk.Fn.sub('arn:aws:logs:${region}:${account}:log-group:/aws/lambda/${lambda}:log-stream:*', {
+              region: cdk.Fn.ref('AWS::Region'),
+              account: cdk.Fn.ref('AWS::AccountId'),
+              lambda: cdk.Fn.ref('OAuthCustomResource'),
+            }),
+          },
+        ],
+      },
+      roles: [cdk.Fn.ref('UserPoolClientRole')],
+    });
+    this.oAuthCustomResourceLogPolicy.addDependsOn(this.oAuthCustomResourcePolicy);
+
+    // oAuth Custom Resource
+    this.oAuthCustomResourceInputs = new cdk.CustomResource(this, 'OAuthCustomResourceInputs', {
+      serviceToken: this.oAuthCustomResource.attrArn,
+      resourceType: 'Custom::LambdaCallout',
+      properties: {
+        hostedUIProviderMeta: cdk.Fn.ref('hostedUIProviderMeta'),
+        oAuthMetadata: cdk.Fn.ref('oAuthMetadata'),
+        webClientId: cdk.Fn.ref('UserPoolClientWeb'),
+        nativeClientId: cdk.Fn.ref('UserPoolClient'),
+        userPoolId: cdk.Fn.ref('UserPool'),
+      },
+    });
+    this.oAuthCustomResourceInputs.node.addDependency(this.oAuthCustomResourceLogPolicy);
+  }
+
+  createMFACustomResource(props: CognitoStackOptions) {
+    // iam role
+    this.mfaLambdaRole = new iam.CfnRole(this, 'MFALambdaRole', {
+      roleName: cdk.Fn.conditionIf(
+        'ShouldNotCreateEnvResources',
+        `${props.resourceNameTruncated}_totp_lambda_role`,
+        cdk.Fn.join('', [`${props.resourceNameTruncated}_totp_lambda_role`, '-', cdk.Fn.ref('env')]),
+      ).toString(),
+      assumeRolePolicyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Principal: {
+              Service: 'lambda.amazonaws.com',
+            },
+            Action: 'sts:AssumeRole',
+          },
+        ],
+      },
+      policies: [
+        {
+          policyName: `${props.resourceNameTruncated}_totp_pass_role_policy`,
+          policyDocument: {
+            Version: '2012-10-17',
+            Statement: [
+              {
+                Effect: 'Allow',
+                Action: ['iam:PassRole'],
+                Resource: cdk.Fn.conditionIf(
+                  'ShouldNotCreateEnvResources',
+                  `arn:aws:iam:::role/${props.resourceNameTruncated}_totp_lambda_role`,
+                  cdk.Fn.join('', [`arn:aws:iam:::role/${props.resourceNameTruncated}__totp_lambda_role`, '-', cdk.Fn.ref('env')]),
+                ),
+              },
+            ],
+          },
+        },
+        {
+          policyName: `${props.resourceNameTruncated}_sns_pass_role_policy`,
+          policyDocument: {
+            Version: '2012-10-17',
+            Statement: [
+              {
+                Effect: 'Allow',
+                Action: ['iam:PassRole'],
+                Resource: cdk.Fn.getAtt('SNSRole', 'Arn'),
+              },
+            ],
+          },
+        },
+      ],
+    });
+    this.mfaLambdaRole.addDependsOn(this.snsRole!);
+    // lambda function
+    /**
+     *   Lambda which sets MFA config values
+         Depends on MFALambdaRole for role ARN
+     */
+    this.mfaLambda = new lambda.CfnFunction(this, 'MFALambda', {
+      code: {
+        zipFile: fs.readFileSync(mfaLambdaFilePath, 'utf-8'),
+      },
+      handler: 'index.handler',
+      role: cdk.Fn.getAtt('MFALambdaRole', 'Arn').toString(),
+      runtime: 'nodejs12.x',
+      timeout: 300,
+    });
+    this.mfaLambda.addDependsOn(this.mfaLambdaRole);
+
+    // MFA lambda policy
+    /**
+    # Sets policy for the role that executes the MFA Lambda
+    # Depends on Userpool for Arn
+    # Marked as depending on MFALambda for easier to understand CFN sequencing
+     */
+    this.mfaLambdaPolicy = new iam.CfnPolicy(this, 'MFALambdaPolicy', {
+      policyName: `${props.resourceNameTruncated}_totp_lambda_iam_policy`,
+      policyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: ['cognito-idp:SetUserPoolMfaConfig'],
+            Resource: cdk.Fn.getAtt('UserPool', 'Arn'),
+          },
+        ],
+      },
+      roles: [
+        cdk.Fn.conditionIf(
+          'ShouldNotCreateEnvResources',
+          `${props.resourceNameTruncated}_totp_lambda_role`,
+          cdk.Fn.join('', [`${props.resourceNameTruncated}_totp_lambda_role`, '-', cdk.Fn.ref('env')]),
+        ).toString(),
+      ],
+    });
+    this.mfaLambdaPolicy.addDependsOn(this.mfaLambda);
+
+    // mfa Log policy
+
+    this.mfaLogPolicy = new iam.CfnPolicy(this, 'MFALogPolicy', {
+      policyName: `${props.resourceNameTruncated}_totp_lambda_log_policy`,
+      policyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
+            Resource: cdk.Fn.sub('arn:aws:logs:${region}:${account}:log-group:/aws/lambda/${lambda}:log-stream:*', {
+              region: cdk.Fn.ref('AWS::Region'),
+              account: cdk.Fn.ref('AWS::AccountId'),
+              lambda: cdk.Fn.ref('MFALambda'),
+            }),
+          },
+        ],
+      },
+      roles: [
+        cdk.Fn.conditionIf(
+          'ShouldNotCreateEnvResources',
+          `${props.resourceNameTruncated}_totp_lambda_role`,
+          cdk.Fn.join('', [`${props.resourceNameTruncated}_totp_lambda_role`, '-', cdk.Fn.ref('env')]),
+        ).toString(),
+      ],
+    });
+    this.mfaLogPolicy.addDependsOn(this.mfaLambdaPolicy);
+
+    // mfa Custom Resource
+    /**
+      # Values passed to MFA Lambda
+      # Depends on UserPool for Arn
+      # Depends on MFALambda for Arn
+      # Marked as depending on MFALambdaPolicy for easier to understand CFN sequencing
+     */
+    this.mfaLambdaInputs = new cdk.CustomResource(this, 'MFALambdaInputs', {
+      serviceToken: this.mfaLambda.attrArn,
+      resourceType: 'Custom::LambdaCallout',
+      properties: {
+        mfaConfiguration: cdk.Fn.ref('mfaConfiguration'),
+        totpEnabled: props.mfaTypes!.includes('TOTP'),
+        smsConfigCaller: cdk.Fn.getAtt('SNSRole', 'Arn'),
+        smsAuthenticationMessage: cdk.Fn.ref('smsAuthenticationMessage'),
+        smsConfigExternalId: `${props.resourceNameTruncated}_role_external_id`,
+        userPoolId: cdk.Fn.ref('UserPool'),
+      },
+    });
+    this.mfaLambdaInputs.node.addDependency(this.mfaLogPolicy);
+  }
+
+  createOpenIdLambdaCustomResource(props: CognitoStackOptions) {
+    // iam role
+    /**
+      # Created to execute Lambda which sets MFA config values
+      # Depends on UserPoolClientInputs to prevent further identity pool resources from being created before userpool is ready
+     */
+    this.openIdLambdaRole = new iam.CfnRole(this, 'OpenIdLambdaRole', {
+      roleName: cdk.Fn.conditionIf(
+        'ShouldNotCreateEnvResources',
+        `${props.resourceNameTruncated}_openid_lambda_role`,
+        cdk.Fn.join('', [`${props.resourceNameTruncated}_openid_lambda_role`, '-', cdk.Fn.ref('env')]),
+      ).toString(),
+      assumeRolePolicyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Principal: {
+              Service: 'lambda.amazonaws.com',
+            },
+            Action: 'sts:AssumeRole',
+          },
+        ],
+      },
+      policies: [
+        {
+          policyName: `${props.resourceNameTruncated}_openid_pass_role_policy`,
+          policyDocument: {
+            Version: '2012-10-17',
+            Statement: [
+              {
+                Effect: 'Allow',
+                Action: ['iam:PassRole'],
+                Resource: cdk.Fn.conditionIf(
+                  'ShouldNotCreateEnvResources',
+                  `arn:aws:iam:::role/${props.resourceNameTruncated}_openid_pass_role_policy`,
+                  cdk.Fn.join('', [`arn:aws:iam:::role/${props.resourceNameTruncated}_openid_pass_role_policy`, '-', cdk.Fn.ref('env')]),
+                ),
+              },
+            ],
+          },
+        },
+      ],
+    });
+    //TODO
+    this.mfaLambdaRole!.node.addDependency(this.userPoolClientInputs!.node!.defaultChild!);
+    // lambda function
+    /**
+     *   Lambda which sets MFA config values
+         Depends on MFALambdaRole for role ARN
+     */
+    this.openIdLambda = new lambda.CfnFunction(this, 'OpenIdLambda', {
+      code: {
+        zipFile: fs.readFileSync(openIdLambdaFilePath, 'utf-8'),
+      },
+      handler: 'index.handler',
+      role: cdk.Fn.getAtt('OpenIdLambdaRole', 'Arn').toString(),
+      runtime: 'nodejs12.x',
+      timeout: 300,
+    });
+    this.openIdLambda.addDependsOn(this.openIdLambdaRole);
+
+    // OPenId lambda policy
+    /**
+    # Sets policy for the role that executes the OpenId Lambda
+    # Depends on OpenIdLambda for Arn
+    # Marked as depending on MFALambda for easier to understand CFN sequencing
+     */
+    this.openIdLambdaIAMPolicy = new iam.CfnPolicy(this, 'OpenIdLambdaIAMPolicy', {
+      policyName: `${props.resourceNameTruncated}_openid_lambda_iam_policy`,
+      policyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: ['iam:CreateOpenIDConnectProvider', 'iam:GetOpenIDConnectProvider', 'iam:AddClientIDToOpenIDConnectProvider'],
+            Resource: cdk.Fn.sub('arn:aws:iam::${account}:oidc-provider/accounts.google.com', {
+              account: cdk.Fn.ref('AWS::AccountId'),
+            }),
+          },
+          {
+            Effect: 'Allow',
+            Action: ['iam:ListOpenIDConnectProviders'],
+            Resource: cdk.Fn.sub('arn:aws:iam::${account}:oidc-provider/${selector}', {
+              account: cdk.Fn.ref('AWS::AccountId'),
+              selector: '*',
+            }),
+          },
+        ],
+      },
+      roles: [
+        cdk.Fn.conditionIf(
+          'ShouldNotCreateEnvResources',
+          `${props.resourceNameTruncated}_openid_lambda_role`,
+          cdk.Fn.join('', [`${props.resourceNameTruncated}_openid_lambda_role`, '-', cdk.Fn.ref('env')]),
+        ).toString(),
+      ],
+    });
+    this.openIdLambdaIAMPolicy.addDependsOn(this.openIdLambda);
+
+    // openId Log policy
+    /**
+    # Sets log policy for the role that executes the OpenId  Lambda
+    # Depends on OpenIdLambda for Arn
+    # Marked as depending on UserPoolClientLambdaPolicy for easier to understand CFN sequencing
+     */
+
+    this.openIdLogPolicy = new iam.CfnPolicy(this, 'OpenIdLogPolicy', {
+      policyName: `${props.resourceNameTruncated}_openid_lambda_log_policy`,
+      policyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
+            Resource: cdk.Fn.sub('arn:aws:logs:${region}:${account}:log-group:/aws/lambda/${lambda}:log-stream:*', {
+              region: cdk.Fn.ref('AWS::Region'),
+              account: cdk.Fn.ref('AWS::AccountId'),
+              lambda: cdk.Fn.ref('OpenIdLambda'),
+            }),
+          },
+        ],
+      },
+      roles: [
+        cdk.Fn.conditionIf(
+          'ShouldNotCreateEnvResources',
+          `${props.resourceNameTruncated}_openid_lambda_role`,
+          cdk.Fn.join('', [`${props.resourceNameTruncated}_openid_lambda_role`, '-', cdk.Fn.ref('env')]),
+        ).toString(),
+      ],
+    });
+    this.openIdLogPolicy.addDependsOn(this.openIdLambdaIAMPolicy);
+
+    // openId Custom Resource
+    /**
+      # Values passed to OpenId Lambda
+      # Depends on OpenId for Arn
+      # Marked as depending on OpenIdLogPolicy for easier to understand CFN sequencing
+     */
+    this.openIdLambdaInputs = new cdk.CustomResource(this, 'OpenIdLambdaInputs', {
+      serviceToken: this.openIdLambda.attrArn,
+      resourceType: 'Custom::LambdaCallout',
+      properties: {
+        clientIdList: props.audiences?.join(),
+        url: 'https://accounts.google.com',
+      },
+    });
+    this.openIdLambdaInputs.node.addDependency(this.openIdLogPolicy);
+  }
+
+  generateIAMPolicies = (props: CognitoStackOptions): void => {
+    props.permissions?.forEach(permission => {
+      const resourceKey = `${props.resourceName}${permission.trigger}${permission.policyName}`;
+      this.lambdaTriggerPermissions![resourceKey] = new iam.CfnPolicy(this, resourceKey, {
+        policyName: resourceKey,
+        policyDocument: {
+          Version: '2012-10-17',
+          Statement: [
+            {
+              Effect: permission.effect,
+              Action: cdk.Lazy.anyValue({
+                produce: () => {
+                  permission.actions.forEach(action => {
+                    return action;
+                  });
+                },
+              }),
+              Resource: cdk.Lazy.stringValue({
+                produce: () => {
+                  if (permission.resource.paramType === 'string') {
+                    return permission.resource.keys as string;
+                  }
+                  if (permission.resource.paramType === '!GetAtt') {
+                    return cdk.Fn.getAtt(permission.resource.keys[0], permission.resource.keys[1]).toString();
+                  }
+                  if (permission.resource.paramType === '!Ref') {
+                    return cdk.Fn.ref(permission.resource.keys as string);
+                  }
+                },
+              }),
+            },
+          ],
+        },
+        roles: [cdk.Fn.join('', [`${props.resourceName}${permission.trigger}`, '-', cdk.Fn.ref('env')])],
+      });
+    });
+  };
+}
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/auth-stack-transform.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/auth-stack-transform.ts
new file mode 100644
index 00000000000..95ab2bccbf0
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/auth-stack-transform.ts
@@ -0,0 +1,522 @@
+import {
+  AmplifyCategories,
+  AmplifySupportedService,
+  pathManager,
+  FeatureFlags,
+  $TSContext,
+  writeCFNTemplate,
+  CFNTemplateFormat,
+  buildOverrideDir,
+  Template,
+  AmplifyStackTemplate,
+  AmplifyCategoryTransform,
+  JSONUtilities,
+  stateManager,
+  $TSAny,
+} from 'amplify-cli-core';
+import { AmplifyAuthCognitoStack } from './auth-cognito-stack-builder';
+import { AuthStackSythesizer } from './stack-synthesizer';
+import * as cdk from '@aws-cdk/core';
+import { AuthInputState } from '../auth-inputs-manager/auth-input-state';
+import { CognitoStackOptions, AuthTriggerConnection, AuthTriggerPermissions } from '../service-walkthrough-types/cognito-user-input-types';
+import _ from 'lodash';
+import * as path from 'path';
+import { printer, formatter } from 'amplify-prompts';
+import { generateNestedAuthTriggerTemplate } from '../utils/generate-auth-trigger-template';
+import { createUserPoolGroups, updateUserPoolGroups } from '../utils/synthesize-resources';
+import { CognitoCLIInputs } from '../service-walkthrough-types/awsCognito-user-input-types';
+import * as vm from 'vm2';
+import * as fs from 'fs-extra';
+import os from 'os';
+
+export class AmplifyAuthTransform extends AmplifyCategoryTransform {
+  private _app: cdk.App;
+  private _category: string;
+  private _service: string;
+  private _authTemplateObj: AmplifyAuthCognitoStack; // Props to modify Root stack data
+  private _synthesizer: AuthStackSythesizer;
+  private _cliInputs: CognitoCLIInputs;
+  private _cognitoStackProps: CognitoStackOptions;
+
+  constructor(resourceName: string) {
+    super(resourceName);
+    this._synthesizer = new AuthStackSythesizer();
+    this._app = new cdk.App();
+    this._category = AmplifyCategories.AUTH;
+    this._service = AmplifySupportedService.COGNITO;
+    this._authTemplateObj = new AmplifyAuthCognitoStack(this._app, 'AmplifyAuthCongitoStack', { synthesizer: this._synthesizer });
+  }
+
+  public async transform(context: $TSContext): Promise<Template> {
+    // parse Input data
+    // validating cli-inputs
+    const cliState = new AuthInputState(this.resourceName);
+    this._cliInputs = cliState.getCLIInputPayload();
+    this._cognitoStackProps = await this.generateStackProps(context);
+
+    const resources = stateManager.getMeta();
+    if (resources.auth?.userPoolGroups) {
+      await updateUserPoolGroups(context, this._cognitoStackProps.resourceName!, this._cognitoStackProps.userPoolGroupList);
+    } else {
+      await createUserPoolGroups(context, this._cognitoStackProps.resourceName!, this._cognitoStackProps.userPoolGroupList);
+    }
+    // generate customm Auth Trigger for Cognito
+    if (this._cognitoStackProps.breakCircularDependency) {
+      await generateNestedAuthTriggerTemplate(this._category, this.resourceName, this._cognitoStackProps);
+    }
+    // this will also include lambda triggers and adminQueries once api and function transform are done
+
+    await this.generateStackResources(this._cognitoStackProps);
+
+    // apply override on Amplify Object having CDK Constructs for Auth Stack
+    await this.applyOverride();
+
+    // generate CFN template
+    const template: Template = await this.synthesizeTemplates();
+
+    // save stack and parameters.json
+    await this.saveBuildFiles(context, template);
+    return template;
+  }
+
+  /**
+   * Generates CFN REsources for Auth
+   * @returns CFN Template
+   */
+
+  private async generateStackResources(props: CognitoStackOptions) {
+    // add CFN parameter
+    this.addCfnParameters(props);
+
+    // add CFN condition
+    this.addCfnConditions(props);
+    // generate Resources
+
+    this._authTemplateObj.generateCognitoStackResources(props);
+
+    //generate Output
+    this.generateCfnOutputs(props);
+  }
+
+  public applyOverride = async (): Promise<void> => {
+    const backendDir = pathManager.getBackendDirPath();
+    const overrideDir = path.join(backendDir, this._category, this.resourceName);
+    const isBuild = await buildOverrideDir(backendDir, overrideDir).catch(error => {
+      printer.warn(`Skipping build as ${error.message}`);
+      return false;
+    });
+    if (isBuild) {
+      const overrideCode: string = await fs.readFile(path.join(overrideDir, 'build', 'override.js'), 'utf-8').catch(() => {
+        formatter.list(['No override File Found', `To override ${this.resourceName} run amplify override auth`]);
+        return '';
+      });
+      const cognitoStackTemplateObj = this._authTemplateObj as AmplifyAuthCognitoStack & AmplifyStackTemplate;
+      const sandboxNode = new vm.NodeVM({
+        console: 'inherit',
+        timeout: 5000,
+        sandbox: {},
+        require: {
+          context: 'sandbox',
+          builtin: ['path'],
+          external: true,
+        },
+      });
+      try {
+        this._authTemplateObj = await sandboxNode
+          .run(overrideCode, path.join(overrideDir, 'build', 'override.js'))
+          .overrideProps(cognitoStackTemplateObj);
+      } catch (err: $TSAny) {
+        const error = new Error(`Skipping override due to ${err}${os.EOL}`);
+        printer.error(`${error}`);
+        error.stack = undefined;
+        throw error;
+      }
+    }
+  };
+  /**
+   *
+   * @returns Object required to generate Stack using cdk
+   */
+  private generateStackProps = async (context: $TSContext): Promise<CognitoStackOptions> => {
+    // roles to append to cognito stacks
+    const roles = {
+      authRoleArn: {
+        'Fn::GetAtt': ['AuthRole', 'Arn'],
+      },
+      unauthRoleArn: {
+        'Fn::GetAtt': ['UnauthRole', 'Arn'],
+      },
+    };
+
+    let cognitoStackProps = {
+      ...this._cliInputs.cognitoConfig,
+      ...roles,
+      breakCircularDependency: FeatureFlags.getBoolean('auth.breakcirculardependency'),
+      dependsOn: [],
+    };
+
+    // get env secrets
+    const teamProviderobj = context.amplify.loadEnvResourceParameters(context, this._category, this.resourceName);
+    if (!_.isEmpty(teamProviderobj)) {
+      cognitoStackProps = Object.assign(cognitoStackProps, teamProviderobj);
+    }
+    // determine permissions needed for each trigger module
+    if (!_.isEmpty(this._cliInputs.cognitoConfig.triggers)) {
+      const permissions = await context.amplify.getTriggerPermissions(
+        context,
+        this._cliInputs.cognitoConfig.triggers,
+        AmplifyCategories.AUTH,
+        this._cliInputs.cognitoConfig.resourceName,
+      );
+
+      const triggerPermissions: AuthTriggerPermissions[] = permissions?.map((i: string) => JSON.parse(i));
+
+      // handle dependsOn data
+      const dependsOnKeys = Object.keys(this._cliInputs.cognitoConfig.triggers).map(
+        i => `${this._cliInputs.cognitoConfig.resourceName}${i}`,
+      );
+      const dependsOn = context.amplify.dependsOnBlock(context, dependsOnKeys, 'Cognito');
+      // generate trigger config
+      const keys = Object.keys(this._cliInputs.cognitoConfig.triggers);
+      // Auth lambda config for Triggers
+      const authTriggerConnections: AuthTriggerConnection[] = [];
+      keys.forEach(key => {
+        let config: AuthTriggerConnection = {
+          triggerType: key === 'PreSignup' ? 'PreSignUp' : key,
+          lambdaFunctionName: key === 'PreSignup' ? 'PreSignUp' : `${this.resourceName}${key}`,
+        };
+        authTriggerConnections.push(config);
+      });
+      cognitoStackProps = Object.assign(cognitoStackProps, { permissions: triggerPermissions, dependsOn, authTriggerConnections });
+    }
+    return cognitoStackProps;
+  };
+
+  /**
+   *
+   * @returns return CFN templates sunthesized by app
+   */
+  private synthesizeTemplates = async (): Promise<Template> => {
+    this._app.synth();
+    const templates = this._synthesizer.collectStacks();
+    return templates.get('AmplifyAuthCongitoStack')!;
+  };
+
+  public saveBuildFiles = async (context: $TSContext, template: Template): Promise<void> => {
+    const cognitoStackFileName = `${this.resourceName}-cloudformation-template.json`;
+    const cognitostackFilePath = path.join(
+      pathManager.getBackendDirPath(),
+      this._category,
+      this.resourceName,
+      'build',
+      cognitoStackFileName,
+    );
+    // write CFN template
+    writeCFNTemplate(template, cognitostackFilePath, {
+      templateFormat: CFNTemplateFormat.JSON,
+    });
+    // write parameters.json
+    this.writeBuildFiles(context);
+  };
+
+  private writeBuildFiles = async (context: $TSContext) => {
+    const parametersJSONFilePath = path.join(
+      pathManager.getBackendDirPath(),
+      this._category,
+      this.resourceName,
+      'build',
+      'parameters.json',
+    );
+
+    const roles = {
+      authRoleArn: {
+        'Fn::GetAtt': ['AuthRole', 'Arn'],
+      },
+      unauthRoleArn: {
+        'Fn::GetAtt': ['UnauthRole', 'Arn'],
+      },
+    };
+
+    //save parameters
+    let parameters = {
+      ...this._cliInputs.cognitoConfig,
+      ...roles,
+      breakCircularDependency: this._cognitoStackProps.breakCircularDependency,
+      dependsOn: [], // to support undefined meta in update,
+    };
+
+    // convert triggers to JSON
+    if (this._cognitoStackProps.triggers && !_.isEmpty(this._cognitoStackProps.triggers)) {
+      this._cognitoStackProps.triggers = JSON.stringify(this._cognitoStackProps.triggers);
+      // convert permissions
+      const triggerPermissions = this._cognitoStackProps.permissions!.map(i => JSON.stringify(i));
+      // convert dependsOn
+      const dependsOn = this._cognitoStackProps.dependsOn;
+      // convert auth trigger connections
+      const authTriggerConnections = this._cognitoStackProps.authTriggerConnections!.map(obj => {
+        const modifiedObj = _.omit(obj, ['lambdaFunctionArn']);
+        return JSON.stringify(modifiedObj);
+      });
+      parameters = Object.assign(parameters, {
+        permissions: triggerPermissions,
+        triggers: this._cognitoStackProps.triggers,
+        dependsOn,
+        authTriggerConnections,
+      });
+    } else if (_.isEmpty(this._cognitoStackProps.triggers)) {
+      parameters = Object.assign(parameters, { triggers: JSON.stringify(this._cognitoStackProps.triggers) });
+    }
+    //save parameters
+    JSONUtilities.writeJson(parametersJSONFilePath, parameters);
+  };
+
+  private generateCfnOutputs = (props: CognitoStackOptions) => {
+    if (props.authSelections === 'identityPoolAndUserPool' || props.authSelections == 'identityPoolOnly') {
+      this._authTemplateObj.addCfnOutput(
+        {
+          value: cdk.Fn.ref('IdentityPool'),
+          description: 'Id for the identity pool',
+        },
+        'IdentityPoolId',
+      );
+
+      this._authTemplateObj.addCfnOutput(
+        {
+          value: cdk.Fn.getAtt('IdentityPool', 'Name').toString(),
+        },
+        'IdentityPoolName',
+      );
+    }
+
+    if (props.hostedUIDomainName) {
+      this._authTemplateObj.addCfnOutput(
+        {
+          value: cdk.Fn.conditionIf(
+            'ShouldNotCreateEnvResources',
+            cdk.Fn.ref('hostedUIDomainName'),
+            cdk.Fn.join('-', [cdk.Fn.ref('hostedUIDomainName'), cdk.Fn.ref('env')]),
+          ).toString(),
+        },
+        'HostedUIDomain',
+      );
+    }
+
+    if (props.oAuthMetadata) {
+      this._authTemplateObj.addCfnOutput(
+        {
+          value: cdk.Fn.ref('oAuthMetadata'),
+        },
+        'OAuthMetadata',
+      );
+    }
+
+    if (props.authSelections !== 'identityPoolOnly') {
+      this._authTemplateObj.addCfnOutput(
+        {
+          value: cdk.Fn.ref('UserPool'),
+          description: 'Id for the user pool',
+        },
+        'UserPoolId',
+      );
+
+      this._authTemplateObj.addCfnOutput(
+        {
+          value: cdk.Fn.getAtt('UserPool', 'Arn').toString(),
+          description: 'Arn for the user pool',
+        },
+        'UserPoolArn',
+      );
+
+      this._authTemplateObj.addCfnOutput(
+        {
+          value: cdk.Fn.ref('userPoolName'),
+        },
+        'UserPoolName',
+      );
+
+      this._authTemplateObj.addCfnOutput(
+        {
+          value: cdk.Fn.ref('UserPoolClientWeb'),
+          description: 'The user pool app client id for web',
+        },
+        'AppClientIDWeb',
+      );
+
+      this._authTemplateObj.addCfnOutput(
+        {
+          value: cdk.Fn.ref('UserPoolClient'),
+          description: 'The user pool app client id',
+        },
+        'AppClientID',
+      );
+
+      this._authTemplateObj.addCfnOutput(
+        {
+          value: cdk.Fn.getAtt('UserPoolClientInputs', 'appSecret').toString(),
+          condition: this._authTemplateObj.getCfnCondition('ShouldOutputAppClientSecrets'),
+        },
+        'AppClientSecret',
+      );
+
+      if (props.mfaConfiguration != 'OFF') {
+        this._authTemplateObj.addCfnOutput(
+          {
+            value: cdk.Fn.getAtt('SNSRole', 'Arn').toString(),
+            description: 'role arn',
+          },
+          'CreatedSNSRole',
+        );
+      }
+
+      if (props.googleClientId) {
+        this._authTemplateObj.addCfnOutput(
+          {
+            value: cdk.Fn.ref('googleClientId'),
+          },
+          'GoogleWebClient',
+        );
+      }
+
+      if (props.googleIos) {
+        this._authTemplateObj.addCfnOutput(
+          {
+            value: cdk.Fn.ref('googleIos'),
+          },
+          'GoogleIOSClient',
+        );
+      }
+
+      if (props.googleAndroid) {
+        this._authTemplateObj.addCfnOutput(
+          {
+            value: cdk.Fn.ref('googleAndroid'),
+          },
+          'GoogleAndroidClient',
+        );
+      }
+
+      if (props.facebookAppId) {
+        this._authTemplateObj.addCfnOutput(
+          {
+            value: cdk.Fn.ref('facebookAppId'),
+          },
+          'FacebookWebClient',
+        );
+      }
+
+      if (props.amazonAppId) {
+        this._authTemplateObj.addCfnOutput(
+          {
+            value: cdk.Fn.ref('amazonAppId'),
+          },
+          'AmazonWebClient',
+        );
+      }
+
+      if (props.appleAppId) {
+        this._authTemplateObj.addCfnOutput(
+          {
+            value: cdk.Fn.ref('appleAppId'),
+          },
+          'AppleWebClient',
+        );
+      }
+    }
+  };
+
+  private addCfnParameters = (props: CognitoStackOptions) => {
+    this._authTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+      },
+      'env',
+    );
+
+    if (!_.isEmpty(props.dependsOn)) {
+      const dependsOn = props.dependsOn;
+      dependsOn?.forEach(param => {
+        param.attributes.forEach(attribute => {
+          this._authTemplateObj.addCfnParameter(
+            {
+              type: 'String',
+              default: `${param.category}${param.resourceName}${attribute}`,
+            },
+            `${param.category}${param.resourceName}${attribute}`,
+          );
+        });
+      });
+    }
+
+    for (const [key, value] of Object.entries(props)) {
+      if (typeof value === 'string' || (typeof value === 'object' && !Array.isArray(value))) {
+        this._authTemplateObj.addCfnParameter(
+          {
+            type: 'String',
+          },
+          `${key}`,
+        );
+      }
+
+      if (typeof value === 'boolean') {
+        this._authTemplateObj.addCfnParameter(
+          {
+            type: 'String',
+          },
+          `${key}`,
+        );
+      }
+      if (typeof value === 'number') {
+        this._authTemplateObj.addCfnParameter(
+          {
+            type: 'String',
+          },
+          `${key}`,
+        );
+      }
+      if (value === 'parentStack') {
+        this._authTemplateObj.addCfnParameter(
+          {
+            type: 'String',
+          },
+          `${key}`,
+        );
+      }
+      if (Array.isArray(value)) {
+        this._authTemplateObj.addCfnParameter(
+          {
+            type: 'CommaDelimitedList',
+          },
+          `${key}`,
+        );
+      }
+    }
+
+    if (Object.keys(props).includes('hostedUIProviderMeta') && !Object.keys(props).includes('hostedUIProviderCreds')) {
+      this._authTemplateObj.addCfnParameter(
+        {
+          type: 'String',
+          default: [],
+        },
+        'hostedUIProviderCreds',
+      );
+    }
+  };
+
+  private addCfnConditions = (props: CognitoStackOptions) => {
+    this._authTemplateObj.addCfnCondition(
+      {
+        expression: cdk.Fn.conditionEquals(cdk.Fn.ref('env'), 'NONE'),
+      },
+      'ShouldNotCreateEnvResources',
+    );
+
+    if (props.authSelections !== 'identityPoolOnly') {
+      this._authTemplateObj.addCfnCondition(
+        {
+          expression: cdk.Fn.conditionEquals(cdk.Fn.ref('userpoolClientGenerateSecret'), true),
+        },
+        'ShouldOutputAppClientSecrets',
+      );
+    }
+  };
+}
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/auth-user-pool-group-stack-builder.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/auth-user-pool-group-stack-builder.ts
new file mode 100644
index 00000000000..4d843c2572f
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/auth-user-pool-group-stack-builder.ts
@@ -0,0 +1,335 @@
+import * as cdk from '@aws-cdk/core';
+import * as iam from '@aws-cdk/aws-iam';
+import * as lambda from '@aws-cdk/aws-lambda';
+import { CfnUserPoolGroup } from '@aws-cdk/aws-cognito';
+import { AmplifyUserPoolGroupStackTemplate } from './types';
+import { AmplifyUserPoolGroupStackOptions } from './user-pool-group-stack-transform';
+import { AmplifyStackTemplate } from 'amplify-cli-core';
+import * as fs from 'fs-extra';
+import { roleMapLambdaFilePath } from '../constants';
+
+const CFN_TEMPLATE_FORMAT_VERSION = '2010-09-09';
+const ROOT_CFN_DESCRIPTION = 'Root Stack for AWS Amplify CLI';
+
+export type AmplifyAuthCognitoStackProps = {
+  synthesizer: cdk.IStackSynthesizer;
+};
+
+export class AmplifyUserPoolGroupStack extends cdk.Stack implements AmplifyUserPoolGroupStackTemplate, AmplifyStackTemplate {
+  _scope: cdk.Construct;
+  private _cfnParameterMap: Map<string, cdk.CfnParameter> = new Map();
+  private _cfnConditionMap: Map<string, cdk.CfnCondition> = new Map();
+  userPoolGroup: Record<string, CfnUserPoolGroup>;
+  userPoolGroupRole: Record<string, iam.CfnRole>;
+  roleMapCustomResource?: cdk.CustomResource;
+  roleMapLambdaFunction?: lambda.CfnFunction;
+  lambdaExecutionRole?: iam.CfnRole;
+
+  constructor(scope: cdk.Construct, id: string, props: AmplifyAuthCognitoStackProps) {
+    super(scope, id, props);
+    this._scope = scope;
+    this.templateOptions.templateFormatVersion = CFN_TEMPLATE_FORMAT_VERSION;
+    this.templateOptions.description = ROOT_CFN_DESCRIPTION;
+    this.userPoolGroup = {};
+    this.userPoolGroupRole = {};
+  }
+  getCfnOutput(logicalId: string): cdk.CfnOutput {
+    throw new Error('Method not implemented.');
+  }
+  getCfnMapping(logicalId: string): cdk.CfnMapping {
+    throw new Error('Method not implemented.');
+  }
+
+  /**
+   *
+   * @param props :cdk.CfnOutputProps
+   * @param logicalId: : lodicalId of the Resource
+   */
+  addCfnOutput(props: cdk.CfnOutputProps, logicalId: string): void {
+    try {
+      new cdk.CfnOutput(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnMapping(props: cdk.CfnMappingProps, logicalId: string): void {
+    try {
+      new cdk.CfnMapping(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnResource(props: cdk.CfnResourceProps, logicalId: string): void {
+    try {
+      new cdk.CfnResource(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnParameter(props: cdk.CfnParameterProps, logicalId: string): void {
+    try {
+      if (this._cfnParameterMap.has(logicalId)) {
+        throw new Error('logical Id already Exists');
+      }
+      this._cfnParameterMap.set(logicalId, new cdk.CfnParameter(this, logicalId, props));
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  /**
+   *
+   * @param props
+   * @param logicalId
+   */
+  addCfnCondition(props: cdk.CfnConditionProps, logicalId: string): void {
+    try {
+      if (this._cfnConditionMap.has(logicalId)) {
+        throw new Error('logical Id already Exists');
+      }
+      this._cfnConditionMap.set(logicalId, new cdk.CfnCondition(this, logicalId, props));
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+
+  getCfnParameter(logicalId: string): cdk.CfnParameter {
+    if (this._cfnParameterMap.has(logicalId)) {
+      return this._cfnParameterMap.get(logicalId)!;
+    } else {
+      throw new Error(`Cfn Parameter with LogicalId ${logicalId} doesnt exist`);
+    }
+  }
+
+  getCfnCondition(logicalId: string): cdk.CfnCondition {
+    if (this._cfnConditionMap.has(logicalId)) {
+      return this._cfnConditionMap.get(logicalId)!;
+    } else {
+      throw new Error(`Cfn Parameter with LogicalId ${logicalId} doesnt exist`);
+    }
+  }
+
+  // add Function for Custom Resource in Root stack
+  /**
+   *
+   * @param _
+   * @returns
+   */
+  public renderCloudFormationTemplate = (_: cdk.ISynthesisSession): string => {
+    return JSON.stringify(this._toCloudFormation(), undefined, 2);
+  };
+
+  generateUserPoolGroupResources = async (props: AmplifyUserPoolGroupStackOptions) => {
+    props.groups.forEach(group => {
+      this.userPoolGroup[`${group.groupName}`] = new CfnUserPoolGroup(this, `${group.groupName}Group`, {
+        userPoolId: this.getCfnParameter(getCfnParamslogicalId(props.cognitoResourceName, 'UserPoolId'))!.valueAsString,
+        groupName: group.groupName,
+        precedence: group.precedence,
+      });
+      this.userPoolGroup[`${group.groupName}`].description = 'override success';
+      if (props.identityPoolName) {
+        this.userPoolGroup[`${group.groupName}`].addPropertyOverride(
+          'RoleArn',
+          cdk.Fn.getAtt(`${group.groupName}GroupRole`, 'Arn').toString(),
+        );
+        this.userPoolGroupRole[`${group.groupName}`] = new iam.CfnRole(this, `${group.groupName}GroupRole`, {
+          roleName: cdk.Fn.join('', [
+            this.getCfnParameter(getCfnParamslogicalId(props.cognitoResourceName, 'UserPoolId'))!.valueAsString,
+            `${group.groupName}GroupRole`,
+          ]),
+          assumeRolePolicyDocument: {
+            Version: '2012-10-17',
+            Statement: [
+              {
+                Sid: '',
+                Effect: 'Allow',
+                Principal: {
+                  Federated: 'cognito-identity.amazonaws.com',
+                },
+                Action: 'sts:AssumeRoleWithWebIdentity',
+                Condition: {
+                  StringEquals: {
+                    'cognito-identity.amazonaws.com:aud': {
+                      Ref: `auth${props.cognitoResourceName}IdentityPoolId`,
+                    },
+                  },
+                  'ForAnyValue:StringLike': { 'cognito-identity.amazonaws.com:amr': 'authenticated' },
+                },
+              },
+            ],
+          },
+        });
+        if (group.customPolicies && group.customPolicies.length > 0) {
+          this.userPoolGroupRole[`${group.groupName}`].addPropertyOverride('Policies', JSON.stringify(group.customPolicies, null, 4));
+        }
+      }
+    });
+
+    if (props.identityPoolName) {
+      this.lambdaExecutionRole = new iam.CfnRole(this, 'LambdaExecutionRole', {
+        roleName: cdk.Fn.conditionIf(
+          'ShouldNotCreateEnvResources',
+          props.cognitoResourceName,
+          cdk.Fn.join('', [`${props.cognitoResourceName}-ExecutionRole`, cdk.Fn.ref('env')]).toString(),
+        ).toString(),
+        assumeRolePolicyDocument: {
+          Version: '2012-10-17',
+          Statement: [
+            {
+              Effect: 'Allow',
+              Principal: {
+                Service: ['lambda.amazonaws.com'],
+              },
+              Action: ['sts:AssumeRole'],
+            },
+          ],
+        },
+        policies: [
+          {
+            policyName: 'UserGroupLogPolicy',
+            policyDocument: {
+              Version: '2012-10-17',
+              Statement: [
+                {
+                  Effect: 'Allow',
+                  Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
+                  Resource: 'arn:aws:logs:*:*:*',
+                },
+              ],
+            },
+          },
+          {
+            policyName: 'UserGroupExecutionPolicy',
+            policyDocument: {
+              Version: '2012-10-17',
+              Statement: [
+                {
+                  Effect: 'Allow',
+                  Action: [
+                    'cognito-identity:SetIdentityPoolRoles',
+                    'cognito-identity:ListIdentityPools',
+                    'cognito-identity:describeIdentityPool',
+                  ],
+                  Resource: '*',
+                },
+              ],
+            },
+          },
+          {
+            policyName: 'UserGroupPassRolePolicy',
+            policyDocument: {
+              Version: '2012-10-17',
+              Statement: [
+                {
+                  Effect: 'Allow',
+                  Action: ['iam:PassRole'],
+                  Resource: [
+                    {
+                      Ref: 'AuthRoleArn',
+                    },
+                    {
+                      Ref: 'UnauthRoleArn',
+                    },
+                  ],
+                },
+              ],
+            },
+          },
+        ],
+      });
+      // lambda function for RoleMap Custom Resource
+      this.roleMapLambdaFunction = new lambda.CfnFunction(this, 'RoleMapLambdaFunction', {
+        code: {
+          zipFile: fs.readFileSync(roleMapLambdaFilePath, 'utf-8'),
+        },
+        handler: 'index.handler',
+        runtime: 'nodejs12.x',
+        timeout: 300,
+        role: cdk.Fn.getAtt('LambdaExecutionRole', 'Arn').toString(),
+      });
+
+      // adding custom trigger roleMap function
+      this.roleMapCustomResource = new cdk.CustomResource(this, 'RoleMapFunctionInput', {
+        serviceToken: this.roleMapLambdaFunction.attrArn,
+        resourceType: 'Custom::LambdaCallout',
+        properties: {
+          AuthRoleArn: cdk.Fn.ref('AuthRoleArn'),
+          UnauthRoleArn: cdk.Fn.ref('UnauthRoleArn'),
+          identityPoolId: cdk.Fn.ref(getCfnParamslogicalId(props.cognitoResourceName, 'IdentityPoolId')),
+          userPoolId: cdk.Fn.ref(getCfnParamslogicalId(props.cognitoResourceName, 'UserPoolId')),
+          appClientIDWeb: cdk.Fn.ref(getCfnParamslogicalId(props.cognitoResourceName, 'AppClientIDWeb')),
+          appClientID: cdk.Fn.ref(getCfnParamslogicalId(props.cognitoResourceName, 'AppClientID')),
+          region: cdk.Fn.ref('AWS::Region'),
+          env: cdk.Fn.ref('env'),
+        },
+      });
+    }
+  };
+}
+
+export const getCfnParamslogicalId = (cognitoResourceName: string, cfnParamName: string): string => {
+  return `auth${cognitoResourceName}${cfnParamName}`;
+};
+
+/**
+ * additional class to merge CFN parameters and CFN outputs as cdk doesnt allow same logical ID of constructs in same stack
+ */
+export class AmplifyUserPoolGroupStackOutputs extends cdk.Stack implements AmplifyStackTemplate {
+  constructor(scope: cdk.Construct, id: string, props: AmplifyAuthCognitoStackProps) {
+    super(scope, id, props);
+  }
+  getCfnParameter(logicalId: string): cdk.CfnParameter {
+    throw new Error('Method not implemented.');
+  }
+  getCfnOutput(logicalId: string): cdk.CfnOutput {
+    throw new Error('Method not implemented.');
+  }
+  getCfnMapping(logicalId: string): cdk.CfnMapping {
+    throw new Error('Method not implemented.');
+  }
+  getCfnCondition(logicalId: string): cdk.CfnCondition {
+    throw new Error('Method not implemented.');
+  }
+
+  addCfnParameter(props: cdk.CfnParameterProps, logicalId: string): void {
+    throw new Error('Method not implemented.');
+  }
+  addCfnOutput(props: cdk.CfnOutputProps, logicalId: string): void {
+    try {
+      new cdk.CfnOutput(this, logicalId, props);
+    } catch (error) {
+      throw new Error(error);
+    }
+  }
+  addCfnMapping(props: cdk.CfnMappingProps, logicalId: string): void {
+    throw new Error('Method not implemented.');
+  }
+  addCfnCondition(props: cdk.CfnConditionProps, logicalId: string): void {
+    throw new Error('Method not implemented.');
+  }
+  addCfnResource(props: cdk.CfnResourceProps, logicalId: string): void {
+    throw new Error('Method not implemented.');
+  }
+
+  public renderCloudFormationTemplate = (_: cdk.ISynthesisSession): string => {
+    return JSON.stringify((this as any)._toCloudFormation(), undefined, 2);
+  };
+}
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/index.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/index.ts
new file mode 100644
index 00000000000..e8d2f6ea910
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/index.ts
@@ -0,0 +1,5 @@
+export { AmplifyAuthCognitoStack } from './auth-cognito-stack-builder';
+export { AmplifyAuthTransform } from './auth-stack-transform';
+export { AmplifyUserPoolGroupStack } from './auth-user-pool-group-stack-builder';
+export { AmplifyUserPoolGroupTransform } from './user-pool-group-stack-transform';
+export { AmplifyAuthCognitoStackTemplate, AmplifyUserPoolGroupStackTemplate } from './types';
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/stack-synthesizer.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/stack-synthesizer.ts
new file mode 100644
index 00000000000..f1814fb9cc5
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/stack-synthesizer.ts
@@ -0,0 +1,45 @@
+import { ISynthesisSession, Stack, LegacyStackSynthesizer } from '@aws-cdk/core';
+import { Template } from 'cloudform-types';
+import { AmplifyAuthCognitoStack } from './auth-cognito-stack-builder';
+import { AmplifyUserPoolGroupStack, AmplifyUserPoolGroupStackOutputs } from './auth-user-pool-group-stack-builder';
+
+export class AuthStackSythesizer extends LegacyStackSynthesizer {
+  private readonly stacks: Map<string, Stack> = new Map();
+  private static readonly stackAssets: Map<string, Template> = new Map();
+
+  protected synthesizeStackTemplate(stack: Stack, session: ISynthesisSession): void {
+    if (
+      stack instanceof AmplifyAuthCognitoStack ||
+      stack instanceof AmplifyUserPoolGroupStack ||
+      stack instanceof AmplifyUserPoolGroupStackOutputs
+    ) {
+      this.addStack(stack);
+      const template = stack.renderCloudFormationTemplate(session) as string;
+      const templateName = stack.node.id;
+      this.setStackAsset(templateName, template);
+    } else {
+      throw new Error(
+        'Error synthesizing the template. Expected Stack to be either instance of AmplifyAuthCognitoStack or AmplifyUserPoolGroupStack',
+      );
+    }
+  }
+
+  setStackAsset(templateName: string, template: string): void {
+    AuthStackSythesizer.stackAssets.set(templateName, JSON.parse(template));
+  }
+
+  collectStacks(): Map<string, Template> {
+    return new Map(AuthStackSythesizer.stackAssets.entries());
+  }
+
+  addStack(stack: Stack) {
+    this.stacks.set(stack.node.id, stack);
+  }
+
+  getStack = (stackName: string): Stack => {
+    if (this.stacks.has(stackName)) {
+      return this.stacks.get(stackName)!;
+    }
+    throw new Error(`Stack ${stackName} is not created`);
+  };
+}
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/types.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/types.ts
new file mode 100644
index 00000000000..85c41290a8c
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/types.ts
@@ -0,0 +1,59 @@
+import * as cdk from '@aws-cdk/core';
+import * as s3 from '@aws-cdk/aws-s3';
+import * as iam from '@aws-cdk/aws-iam';
+import * as cognito from '@aws-cdk/aws-cognito';
+import * as lambda from '@aws-cdk/aws-lambda';
+
+export interface AmplifyAuthCognitoStackTemplate {
+  customMessageConfirmationBucket?: s3.CfnBucket;
+  snsRole?: iam.CfnRole;
+  userPool?: cognito.CfnUserPool;
+  userPoolClientWeb?: cognito.CfnUserPoolClient;
+  userPoolClient?: cognito.CfnUserPoolClient;
+  identityPool?: cognito.CfnIdentityPool;
+  identityPoolRoleMap?: cognito.CfnIdentityPoolRoleAttachment;
+  lambdaConfigPermissions?: Record<string, lambda.CfnPermission>;
+  lambdaTriggerPermissions?: Record<string, iam.CfnPolicy>;
+  // customresources userPoolClient
+  userPoolClientLambda?: lambda.CfnFunction;
+  userPoolClientRole?: iam.CfnRole;
+  userPoolClientLambdaPolicy?: iam.CfnPolicy;
+  userPoolClientLogPolicy?: iam.CfnPolicy;
+  userPoolClientInputs?: cdk.CustomResource;
+  // customresources HostedUI
+  hostedUICustomResource?: lambda.CfnFunction;
+  hostedUICustomResourcePolicy?: iam.CfnPolicy;
+  hostedUICustomResourceLogPolicy?: iam.CfnPolicy;
+  hostedUICustomResourceInputs?: cdk.CustomResource;
+  // custom resource HostedUI Provider
+  hostedUIProvidersCustomResource?: lambda.CfnFunction;
+  hostedUIProvidersCustomResourcePolicy?: iam.CfnPolicy;
+  hostedUIProvidersCustomResourceLogPolicy?: iam.CfnPolicy;
+  hostedUIProvidersCustomResourceInputs?: cdk.CustomResource;
+  // custom resource OAUTH Provider
+  oAuthCustomResource?: lambda.CfnFunction;
+  oAuthCustomResourcePolicy?: iam.CfnPolicy;
+  oAuthCustomResourceLogPolicy?: iam.CfnPolicy;
+  oAuthCustomResourceInputs?: cdk.CustomResource;
+  //custom resource MFA
+  mfaLambda?: lambda.CfnFunction;
+  mfaLogPolicy?: iam.CfnPolicy;
+  mfaLambdaPolicy?: iam.CfnPolicy;
+  mfaLambdaInputs?: cdk.CustomResource;
+  mfaLambdaRole?: iam.CfnRole;
+
+  //custom resource identity pool - OPenId Lambda Role
+  openIdLambda?: lambda.CfnFunction;
+  openIdLogPolicy?: iam.CfnPolicy;
+  openIdLambdaIAMPolicy?: iam.CfnPolicy;
+  openIdLambdaInputs?: cdk.CustomResource;
+  openIdLambdaRole?: iam.CfnRole;
+}
+
+export interface AmplifyUserPoolGroupStackTemplate {
+  userPoolGroup?: Record<string, cognito.CfnUserPoolGroup>;
+  userPoolGroupRole?: Record<string, iam.CfnRole>;
+  roleMapCustomResource?: cdk.CustomResource;
+  lambdaExecutionRole?: iam.CfnRole;
+  roleMapLambdaFunction?: lambda.CfnFunction;
+}
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/user-pool-group-stack-transform.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/user-pool-group-stack-transform.ts
new file mode 100644
index 00000000000..96ff62580de
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/auth-stack-builder/user-pool-group-stack-transform.ts
@@ -0,0 +1,240 @@
+import {
+  $TSContext,
+  AmplifyCategories,
+  AmplifySupportedService,
+  buildOverrideDir,
+  CFNTemplateFormat,
+  JSONUtilities,
+  pathManager,
+  writeCFNTemplate,
+  Template,
+  AmplifyStackTemplate,
+  AmplifyCategoryTransform,
+  $TSAny,
+} from 'amplify-cli-core';
+import { AuthStackSythesizer } from './stack-synthesizer';
+import * as cdk from '@aws-cdk/core';
+import { AuthInputState } from '../auth-inputs-manager/auth-input-state';
+import * as path from 'path';
+import { AmplifyUserPoolGroupStack, AmplifyUserPoolGroupStackOutputs } from './auth-user-pool-group-stack-builder';
+import * as amplifyPrinter from 'amplify-prompts';
+import _ from 'lodash';
+import { CognitoCLIInputs } from '../service-walkthrough-types/awsCognito-user-input-types';
+import { printer } from 'amplify-prompts';
+import * as fs from 'fs-extra';
+import * as vm from 'vm2';
+import os from 'os';
+
+export type UserPoolGroupMetadata = {
+  groupName: string;
+  precedence: number;
+  customPolicies?: any;
+};
+
+export type AmplifyUserPoolGroupStackOptions = {
+  groups: UserPoolGroupMetadata[];
+  identityPoolName?: string;
+  cognitoResourceName: string;
+};
+
+export class AmplifyUserPoolGroupTransform extends AmplifyCategoryTransform {
+  private _app: cdk.App;
+  private _userPoolGroupTemplateObj: AmplifyUserPoolGroupStack; // Props to modify Root stack data
+  private _synthesizer: AuthStackSythesizer;
+  private _synthesizerOutputs: AuthStackSythesizer;
+  private __userPoolGroupTemplateObjOutputs: AmplifyUserPoolGroupStackOutputs;
+  private _authResourceName: string;
+  private _category: string;
+  private _service: string;
+  private _cliInputs: CognitoCLIInputs;
+
+  constructor(resourceName: string) {
+    super(resourceName);
+    this._authResourceName = resourceName;
+    this._synthesizer = new AuthStackSythesizer();
+    this._synthesizerOutputs = new AuthStackSythesizer();
+    this._app = new cdk.App();
+    this._category = AmplifyCategories.AUTH;
+    this._service = AmplifySupportedService.COGNITOUSERPOOLGROUPS;
+  }
+
+  public async transform(context: $TSContext): Promise<Template> {
+    // parse Input data
+    const userPoolGroupStackOptions = await this.generateStackProps(context);
+
+    // generate cfn Constructs and AmplifyRootStackTemplate object to get overridden
+    await this.generateStackResources(userPoolGroupStackOptions);
+
+    // apply override on Amplify Object having CDK Constructs for Root Stack
+    await this.applyOverride();
+
+    // generate CFN template
+    const template: Template = await this.synthesizeTemplates();
+
+    // save stack
+    await this.saveBuildFiles(context, template);
+    return template;
+  }
+
+  /**
+   * Generates CFN REsources for Auth
+   * @returns CFN Template
+   */
+
+  private generateStackResources = async (props: AmplifyUserPoolGroupStackOptions) => {
+    this._userPoolGroupTemplateObj = new AmplifyUserPoolGroupStack(this._app, 'AmplifyUserPoolGroupStack', {
+      synthesizer: this._synthesizer,
+    });
+
+    this.__userPoolGroupTemplateObjOutputs = new AmplifyUserPoolGroupStackOutputs(this._app, 'AmplifyUserPoolGroupStackOutputs', {
+      synthesizer: this._synthesizerOutputs,
+    });
+
+    // add CFN parameters
+    this._userPoolGroupTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+      },
+      'env',
+    );
+
+    this._userPoolGroupTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+      },
+      'AuthRoleArn',
+    );
+
+    this._userPoolGroupTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+      },
+      'UnauthRoleArn',
+    );
+
+    this._userPoolGroupTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+      },
+      `auth${props.cognitoResourceName}UserPoolId`,
+    );
+
+    if (props.identityPoolName) {
+      this._userPoolGroupTemplateObj.addCfnParameter(
+        {
+          type: 'String',
+        },
+        `auth${props.cognitoResourceName}IdentityPoolId`,
+      );
+    }
+
+    this._userPoolGroupTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+      },
+      `auth${props.cognitoResourceName}AppClientID`,
+    );
+
+    this._userPoolGroupTemplateObj.addCfnParameter(
+      {
+        type: 'String',
+      },
+      `auth${props.cognitoResourceName}AppClientIDWeb`,
+    );
+
+    // add CFN condition
+    this._userPoolGroupTemplateObj.addCfnCondition(
+      {
+        expression: cdk.Fn.conditionEquals(this._userPoolGroupTemplateObj.getCfnParameter('env'), 'NONE'),
+      },
+      'ShouldNotCreateEnvResources',
+    );
+
+    // generate resources
+    this._userPoolGroupTemplateObj.generateUserPoolGroupResources(props);
+
+    // generate CFN outputs again to generate same Output Names as cdk doesnt allow resource with same logical names
+    if (props.identityPoolName) {
+      props.groups.forEach(group => {
+        this.__userPoolGroupTemplateObjOutputs.addCfnOutput(
+          {
+            value: cdk.Fn.getAtt(`${group.groupName}GroupRole`, 'Arn').toString(),
+          },
+          `${group.groupName}GroupRole`,
+        );
+      });
+    }
+  };
+
+  public applyOverride = async (): Promise<void> => {
+    const backendDir = pathManager.getBackendDirPath();
+    const overrideDir = path.join(backendDir, this._category, this.resourceName);
+    const isBuild = await buildOverrideDir(backendDir, overrideDir).catch(error => {
+      amplifyPrinter.printer.warn(`Skipping build as ${error.message}`);
+      return false;
+    });
+    if (isBuild) {
+      const overrideCode: string = await fs.readFile(path.join(overrideDir, 'build', 'override.js'), 'utf-8').catch(() => {
+        amplifyPrinter.formatter.list(['No override File Found', `To override ${this.resourceName} run amplify override auth`]);
+        return '';
+      });
+      const cognitoStackTemplateObj = this._userPoolGroupTemplateObj as AmplifyUserPoolGroupStack & AmplifyStackTemplate;
+      const sandboxNode = new vm.NodeVM({
+        console: 'inherit',
+        timeout: 5000,
+        sandbox: {},
+      });
+      try {
+        this._userPoolGroupTemplateObj = sandboxNode.run(overrideCode).overrideProps(cognitoStackTemplateObj);
+      } catch (err: $TSAny) {
+        const error = new Error(`Skipping override due to ${err}${os.EOL}`);
+        printer.error(`${error}`);
+        error.stack = undefined;
+        throw error;
+      }
+    }
+  };
+  /**
+   *
+   * @returns Object required to generate Stack using cdk
+   */
+  private generateStackProps = async (context: $TSContext): Promise<AmplifyUserPoolGroupStackOptions> => {
+    const resourceDirPath = path.join(pathManager.getBackendDirPath(), 'auth', 'userPoolGroups', 'user-pool-group-precedence.json');
+    const groups = JSONUtilities.readJson(resourceDirPath, { throwIfNotExist: true });
+    const cliState = new AuthInputState(this._authResourceName);
+    this._cliInputs = cliState.getCLIInputPayload();
+    const identityPoolName = this._cliInputs.cognitoConfig.identityPoolName;
+    return {
+      groups: groups as UserPoolGroupMetadata[],
+      identityPoolName,
+      cognitoResourceName: this._authResourceName,
+    };
+  };
+
+  /**
+   *
+   * @returns return CFN templates sunthesized by app
+   */
+  public synthesizeTemplates = async (): Promise<Template> => {
+    this._app.synth();
+    const templates = this._synthesizer.collectStacks();
+    const cfnTemplate = templates.get('AmplifyUserPoolGroupStack')!;
+    const cfnTemplateOutputs = templates.get('AmplifyUserPoolGroupStackOutputs')!;
+    Object.assign(cfnTemplate, cfnTemplateOutputs);
+    return cfnTemplate;
+  };
+
+  public saveBuildFiles = async (context: $TSContext, template: Template): Promise<void> => {
+    const cognitoStackFileName = `${this.resourceName}-cloudformation-template.json`;
+    const cognitostackFilePath = path.join(
+      pathManager.getBackendDirPath(),
+      this._category,
+      this.resourceName,
+      'build',
+      cognitoStackFileName,
+    );
+    writeCFNTemplate(template, cognitostackFilePath, {
+      templateFormat: CFNTemplateFormat.JSON,
+    });
+  };
+}
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/constants.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/constants.ts
index 977ff1084c7..2fa4fa7b5ae 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/constants.ts
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/constants.ts
@@ -1,12 +1,21 @@
 import * as path from 'path';
 
+// category
+export const category = 'auth';
+
 // path constants
 export const resourcesRoot = path.normalize(path.join(__dirname, '../../../resources'));
 export const adminAuthAssetRoot = path.join(resourcesRoot, 'adminAuth');
 export const authTriggerAssetFilePath = path.join(resourcesRoot, 'lambda-function.js');
 export const cfnTemplateRoot = path.join(resourcesRoot, 'cloudformation-templates');
 export const triggerRoot = path.normalize(path.join(__dirname, '../../../provider-utils/awscloudformation/triggers'));
-
+export const userPoolClientLambdaFilePath = path.join(resourcesRoot, 'auth-custom-resource', 'userpoolclientLambda.js');
+export const hostedUILambdaFilePath = path.join(resourcesRoot, 'auth-custom-resource', 'hostedUILambda.js');
+export const hostedUIProviderLambdaFilePath = path.join(resourcesRoot, 'auth-custom-resource', 'hostedUIProviderLambda.js');
+export const oauthLambdaFilePath = path.join(resourcesRoot, 'auth-custom-resource', 'oauthLambda.js');
+export const mfaLambdaFilePath = path.join(resourcesRoot, 'auth-custom-resource', 'mfaLambda.js');
+export const openIdLambdaFilePath = path.join(resourcesRoot, 'auth-custom-resource', 'openIdLambda.js');
+export const roleMapLambdaFilePath = path.join(resourcesRoot, 'auth-custom-resource', 'role-map-lambda-function.js');
 export const ENV_SPECIFIC_PARAMS = [
   'facebookAppId',
   'facebookAppIdUserPool',
@@ -52,13 +61,10 @@ export const immutableAttributes = [
 
 export const privateKeys = [
   'facebookAppIdUserPool',
-  'facebookAuthorizeScopes',
   'facebookAppSecretUserPool',
   'googleAppIdUserPool',
-  'googleAuthorizeScopes',
   'googleAppSecretUserPool',
   'loginwithamazonAppIdUserPool',
-  'loginwithamazonAuthorizeScopes',
   'loginwithamazonAppSecretUserPool',
   'signinwithappleClientIdUserPool',
   'signinwithappleTeamIdUserPool',
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/handlers/resource-handlers.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/handlers/resource-handlers.ts
index 8986123be4b..d08672108ff 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/handlers/resource-handlers.ts
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/handlers/resource-handlers.ts
@@ -1,19 +1,33 @@
-import { ServiceQuestionsResult } from '../service-walkthrough-types';
+import { ServiceQuestionHeadlessResult } from '../service-walkthrough-types/cognito-user-input-types';
 import { getAddAuthDefaultsApplier, getUpdateAuthDefaultsApplier } from '../utils/auth-defaults-appliers';
-import { getResourceSynthesizer, getResourceUpdater } from '../utils/synthesize-resources';
+import {
+  getResourceSynthesizer,
+  getResourceUpdater,
+  removeDeprecatedProps,
+  updateUserPoolGroups,
+  createUserPoolGroups,
+} from '../utils/synthesize-resources';
 import { getPostAddAuthMetaUpdater, getPostUpdateAuthMetaUpdater } from '../utils/amplify-meta-updaters';
 import { getPostAddAuthMessagePrinter, getPostUpdateAuthMessagePrinter, printSMSSandboxWarning } from '../utils/message-printer';
-import { getSupportedServices } from '../../supported-services';
+import { supportedServices } from '../../supported-services';
 import { doesConfigurationIncludeSMS } from '../utils/auth-sms-workflow-helper';
+import { AuthInputState } from '../auth-inputs-manager/auth-input-state';
+import { category, ENV_SPECIFIC_PARAMS, privateKeys } from '../constants';
+import { generateAuthStackTemplate } from '../utils/generate-auth-stack-template';
+import { authProviders } from '../assets/string-maps';
+import { CognitoCLIInputs, CognitoConfiguration } from '../service-walkthrough-types/awsCognito-user-input-types';
+import { getAuthResourceName } from '../../../utils/getAuthResourceName';
+import { printer } from 'amplify-prompts';
+import { $TSContext } from 'amplify-cli-core';
 
 /**
- * Factory function that returns a ServiceQuestionsResult consumer that handles all of the resource generation logic.
+ * Factory function that returns a CognitoCLIInputs consumer that handles all of the resource generation logic.
  * The consumer returns the resourceName of the generated resource.
  * @param context The amplify context
  */
-export const getAddAuthHandler = (context: any) => async (request: ServiceQuestionsResult) => {
-  const serviceMetadata = getSupportedServices()[request.serviceName];
-  const { cfnFilename, defaultValuesFilename, provider } = serviceMetadata;
+export const getAddAuthHandler = (context: $TSContext) => async (request: ServiceQuestionHeadlessResult | CognitoConfiguration) => {
+  const serviceMetadata = supportedServices[request.serviceName];
+  const { defaultValuesFilename, provider } = serviceMetadata;
 
   let projectName = context.amplify.getProjectConfig().projectName.toLowerCase();
   const disallowedChars = /[^A-Za-z0-9]+/g;
@@ -21,41 +35,145 @@ export const getAddAuthHandler = (context: any) => async (request: ServiceQuesti
 
   const requestWithDefaults = await getAddAuthDefaultsApplier(context, defaultValuesFilename, projectName)(request);
 
+  // replace secret keys from cli inputs to be stored in deployment secrets
+
+  let sharedParams = Object.assign({}, requestWithDefaults) as any;
+  privateKeys.forEach(p => delete sharedParams[p]);
+  sharedParams = removeDeprecatedProps(sharedParams);
+  // extracting env-specific params from parameters object
+  let envSpecificParams: any = {};
+  const cliInputs = { ...sharedParams };
+  ENV_SPECIFIC_PARAMS.forEach(paramName => {
+    if (paramName in request) {
+      envSpecificParams[paramName] = cliInputs[paramName];
+      delete cliInputs[paramName];
+    }
+  });
+
+  const cognitoCLIInputs: CognitoCLIInputs = {
+    version: '1',
+    cognitoConfig: cliInputs,
+  };
+
+  context.amplify.saveEnvResourceParameters(context, category, cognitoCLIInputs.cognitoConfig.resourceName, envSpecificParams);
+
+  // move this function outside of AddHandler
   try {
-    await getResourceSynthesizer(context, cfnFilename, provider)(requestWithDefaults);
-    await getPostAddAuthMetaUpdater(context, { service: requestWithDefaults.serviceName, providerName: provider })(
-      requestWithDefaults.resourceName!,
+    const cliState = new AuthInputState(cognitoCLIInputs.cognitoConfig.resourceName);
+    // saving cli-inputs except secrets
+    await cliState.saveCLIInputPayload(cognitoCLIInputs);
+    // cdk transformation in this function
+    // start auth transform here
+    await generateAuthStackTemplate(context, cognitoCLIInputs.cognitoConfig.resourceName);
+    // remoe this when api and functions transform are done
+    await getResourceSynthesizer(context, requestWithDefaults);
+
+    getPostAddAuthMetaUpdater(context, { service: cognitoCLIInputs.cognitoConfig.serviceName, providerName: provider })(
+      cliInputs.resourceName,
     );
-    await getPostAddAuthMessagePrinter(context.print)(requestWithDefaults.resourceName!);
+    getPostAddAuthMessagePrinter(cognitoCLIInputs.cognitoConfig.resourceName);
 
     if (doesConfigurationIncludeSMS(request)) {
-      await printSMSSandboxWarning(context.print);
+      await printSMSSandboxWarning();
     }
   } catch (err) {
-    context.print.info(err.stack);
-    context.print.error('There was an error adding the auth resource');
+    printer.info(err.stack);
+    printer.error('There was an error adding the auth resource');
     context.usageData.emitError(err);
     process.exitCode = 1;
   }
-  return requestWithDefaults.resourceName!;
+  return cognitoCLIInputs.cognitoConfig.resourceName;
 };
 
-export const getUpdateAuthHandler = (context: any) => async (request: ServiceQuestionsResult) => {
-  const { cfnFilename, defaultValuesFilename, provider } = getSupportedServices()[request.serviceName];
-  const requestWithDefaults = await getUpdateAuthDefaultsApplier(context, defaultValuesFilename, context.updatingAuth)(request);
+export const getUpdateAuthHandler = (context: any) => async (request: ServiceQuestionHeadlessResult | CognitoConfiguration) => {
+  const { defaultValuesFilename } = supportedServices[request.serviceName];
+  // loading previous cli-inputs
+  const resourceName = await getAuthResourceName(context);
+  const cliState = new AuthInputState(resourceName);
+  let prevCliInputs: CognitoCLIInputs = cliState.getCLIInputPayload();
+  const requestWithDefaults = await getUpdateAuthDefaultsApplier(context, defaultValuesFilename, prevCliInputs!.cognitoConfig)(request);
+  const resources = context.amplify.getProjectDetails().amplifyMeta;
+  if (resources.auth.userPoolGroups) {
+    await updateUserPoolGroups(context, requestWithDefaults.resourceName!, requestWithDefaults.userPoolGroupList);
+  } else {
+    await createUserPoolGroups(context, requestWithDefaults.resourceName!, requestWithDefaults.userPoolGroupList);
+  }
+  if (
+    (!requestWithDefaults.updateFlow && !requestWithDefaults.thirdPartyAuth) ||
+    (requestWithDefaults.updateFlow === 'manual' && !requestWithDefaults.thirdPartyAuth)
+  ) {
+    delete requestWithDefaults.selectedParties;
+    requestWithDefaults.authProviders = [];
+    authProviders.forEach(a => delete (requestWithDefaults as any)[a.answerHashKey]);
+    if (requestWithDefaults.googleIos) {
+      delete requestWithDefaults.googleIos;
+    }
+    if (requestWithDefaults.googleAndroid) {
+      delete requestWithDefaults.googleAndroid;
+    }
+    if (requestWithDefaults.audiences) {
+      delete requestWithDefaults.audiences;
+    }
+  }
+
+  if (requestWithDefaults.useDefault === 'default' || requestWithDefaults.hostedUI === false) {
+    delete requestWithDefaults.oAuthMetadata;
+    delete requestWithDefaults.hostedUIProviderMeta;
+    delete requestWithDefaults.hostedUIProviderCreds;
+    delete requestWithDefaults.hostedUIDomainName;
+    delete requestWithDefaults.authProvidersUserPool;
+  }
+
+  let sharedParams = Object.assign({}, requestWithDefaults) as any;
+  privateKeys.forEach(p => delete sharedParams[p]);
+  sharedParams = removeDeprecatedProps(sharedParams);
+  // extracting env-specific params from parameters object
+  let envSpecificParams: any = {};
+  const cliInputs = { ...sharedParams };
+  ENV_SPECIFIC_PARAMS.forEach(paramName => {
+    if (paramName in request) {
+      envSpecificParams[paramName] = cliInputs[paramName];
+      delete cliInputs[paramName];
+    }
+  });
+  context.amplify.saveEnvResourceParameters(context, category, request.resourceName, envSpecificParams);
+
+  // saving updated request here
+  /**
+   * 1) update cli-inputs manager (get cli-inputs , save cli-inputs)
+   * 2) Save service question Result to cli-inputs.json
+   */
+
+  const cognitoCLIInputs: CognitoCLIInputs = {
+    version: '1',
+    cognitoConfig: cliInputs,
+  };
   try {
-    await getResourceUpdater(context, cfnFilename, provider)(requestWithDefaults);
-    await getPostUpdateAuthMetaUpdater(context)(requestWithDefaults.resourceName!);
-    await getPostUpdateAuthMessagePrinter(context.print)(requestWithDefaults.resourceName!);
+    const cliState = new AuthInputState(cognitoCLIInputs.cognitoConfig.resourceName);
+    const triggers = cognitoCLIInputs.cognitoConfig.triggers;
+    // convert triggers to JSON as overided in defaults
+    if (triggers && typeof triggers === 'string') {
+      cognitoCLIInputs.cognitoConfig.triggers = JSON.parse(triggers);
+    }
+    // saving cli-inputs except secrets
+    await cliState.saveCLIInputPayload(cognitoCLIInputs);
+    // remoe this when api and functions transform are done
+    await getResourceUpdater(context, cliInputs);
+    if (request.updateFlow !== 'updateUserPoolGroups' && request.updateFlow !== 'updateAdminQueries') {
+      await generateAuthStackTemplate(context, cognitoCLIInputs.cognitoConfig.resourceName);
+    }
+
+    await getPostUpdateAuthMetaUpdater(context)(cognitoCLIInputs.cognitoConfig.resourceName);
+    await getPostUpdateAuthMessagePrinter(context.print)(cognitoCLIInputs.cognitoConfig.resourceName);
 
-    if (doesConfigurationIncludeSMS(requestWithDefaults)) {
-      await printSMSSandboxWarning(context.print);
+    if (doesConfigurationIncludeSMS(cliInputs)) {
+      await printSMSSandboxWarning();
     }
   } catch (err) {
-    context.print.info(err.stack);
-    context.print.error('There was an error updating the auth resource');
+    printer.info(err.stack);
+    printer.error('There was an error updating the auth resource');
     context.usageData.emitError(err);
     process.exitCode = 1;
   }
-  return requestWithDefaults.resourceName!;
+  return cognitoCLIInputs.cognitoConfig.resourceName;
 };
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/index.js b/packages/amplify-category-auth/src/provider-utils/awscloudformation/index.js
index 6f1e6260f2c..55a0a458cdb 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/index.js
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/index.js
@@ -5,8 +5,9 @@ const { getAuthResourceName } = require('../../utils/getAuthResourceName');
 const { copyCfnTemplate, saveResourceParameters } = require('./utils/synthesize-resources');
 const { ENV_SPECIFIC_PARAMS, AmplifyAdmin, UserPool, IdentityPool, BothPools, privateKeys } = require('./constants');
 const { getAddAuthHandler, getUpdateAuthHandler } = require('./handlers/resource-handlers');
-const { getSupportedServices } = require('../supported-services');
+const { supportedServices } = require('../supported-services');
 const { importResource, importedAuthEnvInit } = require('./import');
+const { AuthInputState } = require('./auth-inputs-manager/auth-input-state');
 
 function serviceQuestions(context, defaultValuesFilename, stringMapsFilename, serviceWalkthroughFilename, serviceMetadata) {
   const serviceWalkthroughSrc = `${__dirname}/service-walkthroughs/${serviceWalkthroughFilename}`;
@@ -15,15 +16,16 @@ function serviceQuestions(context, defaultValuesFilename, stringMapsFilename, se
 }
 
 async function addResource(context, service) {
-  const serviceMetadata = getSupportedServices()[service];
+  const serviceMetadata = supportedServices[service];
   const { defaultValuesFilename, stringMapsFilename, serviceWalkthroughFilename } = serviceMetadata;
+  // add
   return getAddAuthHandler(context)(
     await serviceQuestions(context, defaultValuesFilename, stringMapsFilename, serviceWalkthroughFilename, serviceMetadata),
   );
 }
 
 async function updateResource(context, { service }) {
-  const serviceMetadata = getSupportedServices()[service];
+  const serviceMetadata = supportedServices[service];
   const { defaultValuesFilename, stringMapsFilename, serviceWalkthroughFilename } = serviceMetadata;
   return getUpdateAuthHandler(context)(
     await serviceQuestions(context, defaultValuesFilename, stringMapsFilename, serviceWalkthroughFilename, serviceMetadata),
@@ -31,12 +33,14 @@ async function updateResource(context, { service }) {
 }
 
 async function updateConfigOnEnvInit(context, category, service) {
-  const srvcMetaData = getSupportedServices().Cognito;
+  const srvcMetaData = supportedServices.Cognito;
   const { defaultValuesFilename, stringMapsFilename, serviceWalkthroughFilename, provider } = srvcMetaData;
 
   const providerPlugin = context.amplify.getPluginInstance(context, provider);
   // previously selected answers
-  const resourceParams = providerPlugin.loadResourceParameters(context, 'auth', service);
+  const currentAuthName = await getAuthResourceName(context);
+  const cliState = new AuthInputState(currentAuthName);
+  const resourceParams = await cliState.loadResourceParameters(context, cliState.getCLIInputPayload());
   // ask only env specific questions
   let currentEnvSpecificValues = context.amplify.loadEnvResourceParameters(context, category, service);
 
@@ -180,7 +184,7 @@ async function migrate(context) {
   if (!Object.keys(existingAuth).length > 0) {
     return;
   }
-  const { provider, cfnFilename, defaultValuesFilename } = getSupportedServices().Cognito;
+  const { provider, cfnFilename, defaultValuesFilename } = supportedServices.Cognito;
   const defaultValuesSrc = `${__dirname}/assets/${defaultValuesFilename}`;
 
   const { roles } = require(defaultValuesSrc);
@@ -430,7 +434,7 @@ async function openIdentityPoolConsole(context, region, identityPoolId) {
 }
 
 function getPermissionPolicies(context, service, resourceName, crudOptions) {
-  const { serviceWalkthroughFilename } = getSupportedServices()[service];
+  const { serviceWalkthroughFilename } = supportedServices[service];
   const serviceWalkthroughSrc = `${__dirname}/service-walkthroughs/${serviceWalkthroughFilename}`;
   const { getIAMPolicies } = require(serviceWalkthroughSrc);
 
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/schemas/awsCognito/CognitoCLIInputs.schema.json b/packages/amplify-category-auth/src/provider-utils/awscloudformation/schemas/awsCognito/CognitoCLIInputs.schema.json
new file mode 100644
index 00000000000..5642677767f
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/schemas/awsCognito/CognitoCLIInputs.schema.json
@@ -0,0 +1,275 @@
+{
+  "type": "object",
+  "properties": {
+    "version": {
+      "type": "string"
+    },
+    "cognitoConfig": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/ServiceQuestionsBaseResult"
+        },
+        {
+          "$ref": "#/definitions/Pick<OAuthResult,\"hostedUI\"|\"hostedUIDomainName\"|\"hostedUIProviderMeta\"|\"oAuthMetadata\">"
+        },
+        {
+          "$ref": "#/definitions/Pick<SocialProviderResult,\"authProvidersUserPool\">"
+        },
+        {
+          "$ref": "#/definitions/IdentityPoolResult"
+        },
+        {
+          "$ref": "#/definitions/PasswordPolicyResult"
+        },
+        {
+          "$ref": "#/definitions/PasswordRecoveryResult"
+        },
+        {
+          "$ref": "#/definitions/MfaResult"
+        },
+        {
+          "$ref": "#/definitions/AdminQueriesResult"
+        },
+        {
+          "$ref": "#/definitions/Triggers"
+        }
+      ]
+    }
+  },
+  "required": ["cognitoConfig"],
+  "definitions": {
+    "ServiceQuestionsBaseResult": {
+      "type": "object",
+      "properties": {
+        "serviceName": {
+          "type": "string",
+          "enum": ["Cognito"]
+        },
+        "resourceName": {
+          "type": "string"
+        },
+        "useDefault": {
+          "enum": ["default", "defaultSocial", "manual"],
+          "type": "string"
+        },
+        "updateFlow": {
+          "enum": ["callbacks", "default", "defaultSocial", "manual", "providers", "updateAdminQueries", "updateUserPoolGroups"],
+          "type": "string"
+        },
+        "requiredAttributes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "authSelections": {
+          "enum": ["identityPoolAndUserPool", "identityPoolOnly", "userPoolOnly"],
+          "type": "string"
+        },
+        "userPoolName": {
+          "type": "string"
+        },
+        "usernameAttributes": {
+          "type": "array",
+          "items": {
+            "enum": ["email", "phone_number"],
+            "type": "string"
+          }
+        },
+        "userPoolGroups": {
+          "type": "boolean"
+        },
+        "userPoolGroupList": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "userpoolClientRefreshTokenValidity": {
+          "type": "number"
+        },
+        "userpoolClientReadAttributes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "userpoolClientWriteAttributes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "userpoolClientSetAttributes": {
+          "type": "boolean"
+        },
+        "usernameCaseSensitive": {
+          "type": "boolean"
+        },
+        "verificationBucketName": {
+          "type": "string"
+        },
+        "resourceNameTruncated": {
+          "type": "string"
+        },
+        "sharedId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "authSelections",
+        "requiredAttributes",
+        "resourceName",
+        "serviceName",
+        "useDefault",
+        "userpoolClientReadAttributes",
+        "userpoolClientWriteAttributes"
+      ]
+    },
+    "Pick<OAuthResult,\"hostedUI\"|\"hostedUIDomainName\"|\"hostedUIProviderMeta\"|\"oAuthMetadata\">": {
+      "type": "object",
+      "properties": {
+        "hostedUI": {
+          "type": "boolean"
+        },
+        "hostedUIDomainName": {
+          "type": "string"
+        },
+        "hostedUIProviderMeta": {},
+        "oAuthMetadata": {}
+      }
+    },
+    "Pick<SocialProviderResult,\"authProvidersUserPool\">": {
+      "type": "object",
+      "properties": {
+        "authProvidersUserPool": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "IdentityPoolResult": {
+      "type": "object",
+      "properties": {
+        "thirdPartyAuth": {
+          "type": "boolean"
+        },
+        "identityPoolName": {
+          "type": "string"
+        },
+        "allowUnauthenticatedIdentities": {
+          "type": "boolean"
+        },
+        "authProviders": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "googleClientId": {
+          "type": "string"
+        },
+        "googleIos": {
+          "type": "string"
+        },
+        "googleAndroid": {
+          "type": "string"
+        },
+        "facebookAppId": {
+          "type": "string"
+        },
+        "amazonAppId": {
+          "type": "string"
+        },
+        "appleAppId": {
+          "type": "string"
+        },
+        "selectedParties": {
+          "type": "string"
+        },
+        "audiences": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "PasswordPolicyResult": {
+      "type": "object",
+      "properties": {
+        "passwordPolicyCharacters": {
+          "type": "array",
+          "items": {
+            "enum": ["Requires Lowercase", "Requires Numbers", "Requires Symbols", "Requires Uppercase"],
+            "type": "string"
+          }
+        },
+        "passwordPolicyMinLength": {
+          "type": "number"
+        }
+      }
+    },
+    "PasswordRecoveryResult": {
+      "type": "object",
+      "properties": {
+        "emailVerificationMessage": {
+          "type": "string"
+        },
+        "emailVerificationSubject": {
+          "type": "string"
+        },
+        "smsVerificationMessage": {
+          "type": "string"
+        },
+        "autoVerifiedAttributes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "required": ["autoVerifiedAttributes"]
+    },
+    "MfaResult": {
+      "type": "object",
+      "properties": {
+        "mfaConfiguration": {
+          "enum": ["OFF", "ON", "OPTIONAL"],
+          "type": "string"
+        },
+        "mfaTypes": {
+          "type": "array",
+          "items": {
+            "enum": ["SMS Text Message", "TOTP"],
+            "type": "string"
+          }
+        },
+        "smsAuthenticationMessage": {
+          "type": "string"
+        }
+      },
+      "required": ["mfaConfiguration"]
+    },
+    "AdminQueriesResult": {
+      "type": "object",
+      "properties": {
+        "adminQueries": {
+          "type": "boolean"
+        },
+        "adminQueryGroup": {
+          "type": "string"
+        }
+      }
+    },
+    "Triggers": {
+      "type": "object",
+      "properties": {
+        "triggers": {}
+      }
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/service-walkthrough-types/awsCognito-user-input-types.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/service-walkthrough-types/awsCognito-user-input-types.ts
new file mode 100644
index 00000000000..40030ee66b8
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/service-walkthrough-types/awsCognito-user-input-types.ts
@@ -0,0 +1,118 @@
+export interface CognitoCLIInputs {
+  version?: string;
+  cognitoConfig: CognitoConfiguration;
+}
+
+export type CognitoConfiguration = ServiceQuestionsBaseResult &
+  OAuthResult &
+  SocialProviderResult &
+  IdentityPoolResult &
+  PasswordPolicyResult &
+  PasswordRecoveryResult &
+  MfaResult &
+  AdminQueriesResult &
+  Triggers;
+
+export interface ServiceQuestionsBaseResult {
+  serviceName: 'Cognito';
+  resourceName: string;
+  useDefault: 'default' | 'defaultSocial' | 'manual';
+  updateFlow?: 'default' | 'defaultSocial' | 'manual' | 'callbacks' | 'providers' | 'updateUserPoolGroups' | 'updateAdminQueries';
+  requiredAttributes: string[];
+  authSelections: 'userPoolOnly' | 'identityPoolAndUserPool' | 'identityPoolOnly';
+  userPoolName?: string;
+  usernameAttributes?: UsernameAttributes[];
+  aliasAttributes?: AliasAttributes[];
+  userPoolGroups?: boolean;
+  userPoolGroupList?: string[];
+  userpoolClientRefreshTokenValidity?: number;
+  userpoolClientReadAttributes: string[];
+  userpoolClientWriteAttributes: string[];
+  userpoolClientSetAttributes?: boolean;
+  usernameCaseSensitive?: boolean;
+  verificationBucketName?: string;
+  resourceNameTruncated?: string;
+  sharedId?: string;
+  userpoolClientGenerateSecret: boolean;
+  userpoolClientLambdaRole: string;
+}
+
+export interface OAuthResult {
+  hostedUI?: boolean;
+  hostedUIDomainName?: string;
+  hostedUIProviderMeta?: any;
+  hostedUIProviderCreds?: any;
+  AllowedOAuthFlows?: 'code' | 'implicit';
+  AllowedOAuthScopes?: string[];
+  newCallbackURLs?: string[];
+  newLogoutURLs?: string[];
+  oAuthMetadata?: any;
+}
+
+export interface SocialProviderResult {
+  authProvidersUserPool?: string[];
+  facebookAppIdUserPool?: string;
+  facebookAppSecretUserPool?: string;
+  googleAppIdUserPool?: string;
+  googleAppSecretUserPool?: string;
+  loginwithamazonAppIdUserPool?: string;
+  loginwithamazonAppSecretUserPool?: string;
+  signinwithappleClientIdUserPool?: string;
+  signinwithappleTeamIdUserPool?: string;
+  signinwithappleKeyIdUserPool?: string;
+  signinwithapplePrivateKeyUserPool?: string;
+}
+
+export interface IdentityPoolResult {
+  thirdPartyAuth?: boolean;
+  identityPoolName?: string;
+  allowUnauthenticatedIdentities?: boolean;
+  authProviders?: string[];
+  googleClientId?: string;
+  googleIos?: string;
+  googleAndroid?: string;
+  facebookAppId?: string;
+  amazonAppId?: string;
+  appleAppId?: string;
+  selectedParties?: string; // serialized json
+  audiences?: string[];
+}
+
+export interface PasswordRecoveryResult {
+  emailVerificationMessage?: string;
+  emailVerificationSubject?: string;
+  smsVerificationMessage?: string;
+  autoVerifiedAttributes: string[];
+}
+
+export interface MfaResult {
+  mfaConfiguration: 'OPTIONAL' | 'ON' | 'OFF';
+  mfaTypes?: ('SMS Text Message' | 'TOTP')[];
+  smsAuthenticationMessage?: string;
+}
+
+export interface AdminQueriesResult {
+  adminQueries?: boolean;
+  adminQueryGroup?: string;
+}
+
+export interface PasswordPolicyResult {
+  passwordPolicyCharacters?: PasswordPolicy[];
+  passwordPolicyMinLength?: number;
+}
+
+export enum AttributeType {
+  EMAIL = 'email',
+  PHONE_NUMBER = 'phone_number',
+  PREFERRED_USERNAME = 'preferred_username',
+}
+
+export type PasswordPolicy = 'Requires Lowercase' | 'Requires Numbers' | 'Requires Symbols' | 'Requires Uppercase';
+
+export type UsernameAttributes = AttributeType.EMAIL | AttributeType.PHONE_NUMBER;
+
+export type AliasAttributes = AttributeType.EMAIL | AttributeType.PHONE_NUMBER | AttributeType.PREFERRED_USERNAME;
+
+export interface Triggers {
+  triggers?: any; // TODO create a type for this
+}
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/service-walkthrough-types.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/service-walkthrough-types/cognito-user-input-types.ts
similarity index 77%
rename from packages/amplify-category-auth/src/provider-utils/awscloudformation/service-walkthrough-types.ts
rename to packages/amplify-category-auth/src/provider-utils/awscloudformation/service-walkthrough-types/cognito-user-input-types.ts
index 617e47b9d8d..b5a22080f71 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/service-walkthrough-types.ts
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/service-walkthrough-types/cognito-user-input-types.ts
@@ -1,8 +1,33 @@
 // Some convenience types for the existing service walkthrough logic
 
 import { $TSObject } from 'amplify-cli-core';
+import { FunctionDependency } from 'amplify-function-plugin-interface';
+import { CognitoConfiguration } from './awsCognito-user-input-types';
+
+export type AuthTriggerPermissions = {
+  policyName: string;
+  trigger: string;
+  effect: string;
+  actions: string[];
+  resource: {
+    paramType: string;
+    keys: string | string[];
+  };
+};
+
+export type CognitoStackOptions = CognitoConfiguration & AuthStackMetadata;
 
-export type ServiceQuestionsResult = ServiceQuestionsBaseResult &
+type AuthStackMetadata = {
+  authRoleArn: $TSObject;
+  unauthRoleArn: $TSObject;
+  dependsOn?: FunctionDependency[];
+  parentStack?: string;
+  breakCircularDependency: boolean;
+  permissions?: AuthTriggerPermissions[];
+  authTriggerConnections?: AuthTriggerConnection[];
+};
+
+export type ServiceQuestionHeadlessResult = ServiceQuestionsBaseResult &
   OAuthResult &
   SocialProviderResult &
   IdentityPoolResult &
@@ -18,16 +43,20 @@ export interface ServiceQuestionsBaseResult {
   useDefault: 'default' | 'defaultSocial' | 'manual';
   updateFlow?: 'default' | 'defaultSocial' | 'manual' | 'callbacks' | 'providers' | 'updateUserPoolGroups' | 'updateAdminQueries';
   requiredAttributes: string[];
-  authSelections: 'userPoolOnly' | 'identityPoolAndUserPool';
+  authSelections: 'userPoolOnly' | 'identityPoolAndUserPool' | 'identityPoolOnly';
   userPoolName?: string;
   usernameAttributes?: UsernameAttributes[];
-  userPoolGroups: boolean;
+  aliasAttributes?: AliasAttributes[];
+  userPoolGroups?: boolean;
   userPoolGroupList?: string[];
   userpoolClientRefreshTokenValidity?: number;
   userpoolClientReadAttributes: string[];
   userpoolClientWriteAttributes: string[];
+  userpoolClientSetAttributes?: boolean;
   usernameCaseSensitive?: boolean;
-  authTriggerConnections?: string;
+  verificationBucketName?: string;
+  resourceNameTruncated?: string;
+  sharedId?: string;
 }
 
 export interface OAuthResult {
@@ -57,7 +86,7 @@ export interface SocialProviderResult {
 }
 
 export interface IdentityPoolResult {
-  thirdPartyAuth: boolean;
+  thirdPartyAuth?: boolean;
   identityPoolName?: string;
   allowUnauthenticatedIdentities?: boolean;
   authProviders: string[];
@@ -105,6 +134,7 @@ export type PasswordPolicy = 'Requires Lowercase' | 'Requires Numbers' | 'Requir
 export type UsernameAttributes = AttributeType.EMAIL | AttributeType.PHONE_NUMBER;
 
 export type AliasAttributes = AttributeType.EMAIL | AttributeType.PHONE_NUMBER | AttributeType.PREFERRED_USERNAME;
+
 export interface Triggers {
   triggers?: any; // TODO create a type for this
 }
@@ -123,7 +153,7 @@ export enum TriggerType {
 
 export type AuthTriggerConnection = {
   lambdaFunctionName: string;
-  triggerType: TriggerType;
+  triggerType: string;
   lambdaFunctionArn?: string;
 };
 
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/amplify-meta-updaters.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/amplify-meta-updaters.ts
index 7c39eb2e072..5113ae38928 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/amplify-meta-updaters.ts
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/amplify-meta-updaters.ts
@@ -1,6 +1,5 @@
 import * as path from 'path';
-import { JSONUtilities, pathManager } from 'amplify-cli-core';
-import { transformUserPoolGroupSchema } from './transform-user-pool-group';
+import { JSONUtilities, pathManager, $TSAny } from 'amplify-cli-core';
 import { authProviders as authProviderList } from '../assets/string-maps';
 import { AuthParameters } from '../import/types';
 
@@ -18,7 +17,7 @@ export const getPostAddAuthMetaUpdater =
       service: resultMetadata.service,
       providerPlugin: resultMetadata.providerName,
     };
-    const parametersJSONPath = path.join(context.amplify.pathManager.getBackendDirPath(), 'auth', resourceName, 'parameters.json');
+    const parametersJSONPath = path.join(context.amplify.pathManager.getBackendDirPath(), 'auth', resourceName, 'build', 'parameters.json');
     const authParameters = JSONUtilities.readJson<AuthParameters>(parametersJSONPath)!;
 
     if (authParameters.dependsOn) {
@@ -65,7 +64,7 @@ export const getPostAddAuthMetaUpdater =
  * @param context The amplify context
  */
 export const getPostUpdateAuthMetaUpdater = (context: any) => async (resourceName: string) => {
-  const resourceDirPath = path.join(pathManager.getBackendDirPath(), 'auth', resourceName, 'parameters.json');
+  const resourceDirPath = path.join(pathManager.getBackendDirPath(), 'auth', resourceName, 'build', 'parameters.json');
   const authParameters = JSONUtilities.readJson<AuthParameters>(resourceDirPath)!;
   if (authParameters.dependsOn) {
     context.amplify.updateamplifyMetaAfterResourceUpdate('auth', resourceName, 'dependsOn', authParameters.dependsOn);
@@ -73,7 +72,7 @@ export const getPostUpdateAuthMetaUpdater = (context: any) => async (resourceNam
 
   let customAuthConfigured = false;
   if (authParameters.triggers) {
-    const triggers = JSON.parse(authParameters.triggers);
+    const triggers = JSONUtilities.parse<$TSAny>(authParameters.triggers);
     customAuthConfigured =
       !!triggers.DefineAuthChallenge &&
       triggers.DefineAuthChallenge.length > 0 &&
@@ -101,7 +100,6 @@ export const getPostUpdateAuthMetaUpdater = (context: any) => async (resourceNam
     ];
 
     context.amplify.updateamplifyMetaAfterResourceUpdate('auth', 'userPoolGroups', 'dependsOn', userPoolGroupDependsOn);
-    await transformUserPoolGroupSchema(context);
   }
   return resourceName;
 };
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/attach-prev-params-to-context.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/attach-prev-params-to-context.ts
index a2dbd8bedf4..f072efc78d1 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/attach-prev-params-to-context.ts
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/attach-prev-params-to-context.ts
@@ -1,11 +1,11 @@
 import { getAuthResourceName } from '../../../utils/getAuthResourceName';
-import { getSupportedServices } from '../../supported-services';
+import { AuthInputState } from '../auth-inputs-manager/auth-input-state';
 
 /**
  * Some existing code relies on the existing auth parameters being attached to context.updatingAuth
  */
 export const attachPrevParamsToContext = async (context: any) => {
   const resourceName = await getAuthResourceName(context);
-  const providerPlugin = context.amplify.getPluginInstance(context, getSupportedServices().Cognito.provider);
-  context.updatingAuth = providerPlugin.loadResourceParameters(context, 'auth', resourceName);
+  const cliState = new AuthInputState(resourceName);
+  context.updatingAuth = await cliState.loadResourceParameters(context, cliState.getCLIInputPayload());
 };
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/auth-defaults-appliers.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/auth-defaults-appliers.ts
index 65c22de9c2b..725588347c1 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/auth-defaults-appliers.ts
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/auth-defaults-appliers.ts
@@ -1,67 +1,69 @@
-import { ServiceQuestionsResult } from '../service-walkthrough-types';
 import { verificationBucketName } from './verification-bucket-name';
 import _ from 'lodash';
 import { structureOAuthMetadata } from '../service-walkthroughs/auth-questions';
 import { removeDeprecatedProps } from './synthesize-resources';
 import { immutableAttributes, safeDefaults } from '../constants';
 import { FeatureFlags } from 'amplify-cli-core';
+import { CognitoConfiguration } from '../service-walkthrough-types/awsCognito-user-input-types';
+import { ServiceQuestionHeadlessResult } from '../service-walkthrough-types/cognito-user-input-types';
+import { $TSContext } from 'amplify-cli-core';
 
 /**
- * Factory function that returns a function that applies default values to a ServiceQuestionsResult request.
+ * Factory function that returns a function that applies default values to a CognitoConfiguation request.
  * It does not overwrite existing values in the request.
  *
  * The logic here has been refactored from service-walkthroughs/auth-questions.js and is mostly unchanged
  * @param defaultValuesFilename The filename to fetch defaults from
  * @param projectName The name of the current project (used to generate some default values)
  */
-export const getAddAuthDefaultsApplier = (context: any, defaultValuesFilename: string, projectName: string) => async (
-  result: ServiceQuestionsResult,
-): Promise<ServiceQuestionsResult> => {
-  const { functionMap, generalDefaults, roles, getAllDefaults } = await import(`../assets/${defaultValuesFilename}`);
-  result = assignDefaults({}, generalDefaults(projectName), result);
+export const getAddAuthDefaultsApplier =
+  (context: $TSContext, defaultValuesFilename: string, projectName: string) =>
+  async (result: CognitoConfiguration | ServiceQuestionHeadlessResult): Promise<CognitoConfiguration> => {
+    const { functionMap, generalDefaults, roles, getAllDefaults } = await import(`../assets/${defaultValuesFilename}`);
+    result = assignDefaults({}, generalDefaults(projectName), result);
 
-  await verificationBucketName(result);
+    await verificationBucketName(result);
 
-  structureOAuthMetadata(result, context, getAllDefaults, context.amplify); // adds "oauthMetadata" to result
+    structureOAuthMetadata(result, context, getAllDefaults, context.amplify); // adds "oauthMetadata" to result
 
-  // Make the usernames for Cognito case-insensitive by default when it is created, if feature flag
-  // is enabled.
-  if (FeatureFlags.getBoolean('auth.enableCaseInsensitivity')) {
-    result.usernameCaseSensitive = false;
-  }
+    // Make the usernames for Cognito case-insensitive by default when it is created, if feature flag
+    // is enabled.
+    if (FeatureFlags.getBoolean('auth.enableCaseInsensitivity')) {
+      result.usernameCaseSensitive = false;
+    }
 
-  /* merge actual answers object into props object,
-   * ensuring that manual entries override defaults */
-  return assignDefaults({}, functionMap[result.authSelections](result.resourceName), result, roles);
-};
+    /* merge actual answers object into props object,
+     * ensuring that manual entries override defaults */
+    return assignDefaults({}, functionMap[result.authSelections](result.resourceName), result, roles);
+  };
 
-export const getUpdateAuthDefaultsApplier = (context: any, defaultValuesFilename: string, previousResult: ServiceQuestionsResult) => async (
-  result: ServiceQuestionsResult,
-): Promise<ServiceQuestionsResult> => {
-  const { functionMap, getAllDefaults } = await import(`../assets/${defaultValuesFilename}`);
-  if (!result.authSelections) {
-    result.authSelections = previousResult.authSelections ?? 'identityPoolAndUserPool';
-  }
+export const getUpdateAuthDefaultsApplier =
+  (context: $TSContext, defaultValuesFilename: string, previousResult: CognitoConfiguration) =>
+  async (result: CognitoConfiguration | ServiceQuestionHeadlessResult): Promise<CognitoConfiguration> => {
+    const { functionMap, getAllDefaults } = await import(`../assets/${defaultValuesFilename}`);
+    if (!result.authSelections) {
+      result.authSelections = previousResult.authSelections ?? 'identityPoolAndUserPool';
+    }
 
-  const defaults = functionMap[result.authSelections](previousResult.resourceName);
+    const defaults = functionMap[result.authSelections](previousResult.resourceName);
 
-  // ensure immutable attributes are removed from result
-  immutableAttributes.filter(pv => pv in previousResult).forEach(pv => delete (result as any)[pv]);
+    // ensure immutable attributes are removed from result
+    immutableAttributes.filter(pv => pv in previousResult).forEach(pv => delete (result as any)[pv]);
 
-  if (['default', 'defaultSocial'].includes(result.useDefault)) {
-    safeDefaults.forEach(sd => delete (previousResult as any)[sd]);
-  }
+    if (['default', 'defaultSocial'].includes(result.useDefault)) {
+      safeDefaults.forEach(sd => delete (previousResult as any)[sd]);
+    }
 
-  await verificationBucketName(result, previousResult);
+    await verificationBucketName(result, previousResult);
 
-  structureOAuthMetadata(result, context, getAllDefaults, context.amplify); // adds "oauthMetadata" to result
+    structureOAuthMetadata(result, context, getAllDefaults, context.amplify); // adds "oauthMetadata" to result
 
-  // If there are new trigger selections, make sure they overwrite the previous selections
-  if (!_.isEmpty(result.triggers)) {
-    previousResult.triggers = Object.assign({}, result.triggers);
-  }
-  return assignDefaults({}, defaults, removeDeprecatedProps(previousResult), result);
-};
+    // If there are new trigger selections, make sure they overwrite the previous selections
+    if (!_.isEmpty(result.triggers)) {
+      previousResult.triggers = Object.assign({}, result.triggers);
+    }
+    return assignDefaults({}, defaults, removeDeprecatedProps(previousResult), result);
+  };
 
 // same as _.assign except undefined values won't overwrite existing values
 // typed to accept up to 4 params but could be typed to accept any number of params
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/auth-request-adaptors.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/auth-request-adaptors.ts
index 734a30f01a6..c126f084a5a 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/auth-request-adaptors.ts
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/auth-request-adaptors.ts
@@ -19,7 +19,6 @@ import { identityPoolProviders, userPoolProviders } from '../service-walkthrough
 import { isEmpty, merge } from 'lodash';
 import { authProviders as authProviderList } from '../assets/string-maps';
 import {
-  ServiceQuestionsResult,
   OAuthResult,
   SocialProviderResult,
   IdentityPoolResult,
@@ -31,20 +30,20 @@ import {
   UsernameAttributes,
   AliasAttributes,
   AttributeType,
-} from '../service-walkthrough-types';
+  ServiceQuestionHeadlessResult,
+} from '../service-walkthrough-types/cognito-user-input-types';
 import { pascalCase } from 'change-case';
-import { FeatureFlags } from 'amplify-cli-core';
 
 export type AddAuthRequestAdaptorFactory = (projectType: string) => AddAuthRequestAdaptor;
 
-export type AddAuthRequestAdaptor = (request: AddAuthRequest) => ServiceQuestionsResult;
+export type AddAuthRequestAdaptor = (request: AddAuthRequest) => ServiceQuestionHeadlessResult;
 /**
- * Factory function that returns a function to convert an AddAuthRequest into the existing ServiceQuestionsResult output format
+ * Factory function that returns a function to convert an AddAuthRequest into the existing CognitoConfiguation output format
  * @param projectType The project type (such as 'javascript', 'ios', 'android')
  */
 export const getAddAuthRequestAdaptor: AddAuthRequestAdaptorFactory =
   projectType =>
-  ({ serviceConfiguration: cognitoConfig, resourceName }): ServiceQuestionsResult => {
+  ({ serviceConfiguration: cognitoConfig, resourceName }): ServiceQuestionHeadlessResult => {
     const userPoolConfig = cognitoConfig.userPoolConfiguration;
     const identityPoolConfig = cognitoConfig.includeIdentityPool ? cognitoConfig.identityPoolConfiguration : undefined;
     const requiredAttributes = userPoolConfig.requiredSignupAttributes.map(att => att.toLowerCase());
@@ -59,7 +58,7 @@ export const getAddAuthRequestAdaptor: AddAuthRequestAdaptorFactory =
 
 export const getUpdateAuthRequestAdaptor =
   (projectType: string, requiredAttributes: string[]) =>
-  ({ serviceModification }: UpdateAuthRequest): ServiceQuestionsResult => {
+  ({ serviceModification }: UpdateAuthRequest): ServiceQuestionHeadlessResult => {
     const idPoolModification = serviceModification.includeIdentityPool ? serviceModification.identityPoolModification : undefined;
     return {
       serviceName: serviceModification.serviceName,
@@ -78,9 +77,7 @@ const immutableAttributeAdaptor = (userPoolConfig: CognitoUserPoolConfiguration,
   return {
     userPoolName: userPoolConfig.userPoolName,
     usernameAttributes: signinAttributeMap[userPoolConfig.signinMethod],
-    aliasAttributes: FeatureFlags.getBoolean('auth.forceAliasAttributes')
-      ? userPoolConfig.aliasAttributes?.map(attr => aliasAttributeMap[attr]) ?? []
-      : [],
+    aliasAttributes: userPoolConfig.aliasAttributes?.map(attr => aliasAttributeMap[attr]) ?? [],
     ...immutableIdentityPoolMap(identityPoolConfig),
   };
 };
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/auth-sms-workflow-helper.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/auth-sms-workflow-helper.ts
index 6b2531fa7bb..6fbe74ec975 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/auth-sms-workflow-helper.ts
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/auth-sms-workflow-helper.ts
@@ -1,8 +1,9 @@
 import { $TSContext } from 'amplify-cli-core';
 import { ProviderUtils } from '../import/types';
-
-import { ServiceQuestionsResult } from '../service-walkthrough-types';
-import { getSupportedServices } from '../../supported-services';
+import { supportedServices } from '../../supported-services';
+import { ServiceQuestionHeadlessResult } from '../service-walkthrough-types/cognito-user-input-types';
+import { AuthInputState } from '../auth-inputs-manager/auth-input-state';
+import { CognitoConfiguration } from '../service-walkthrough-types/awsCognito-user-input-types';
 
 export type UserPoolMessageConfiguration = {
   mfaConfiguration?: string;
@@ -10,7 +11,7 @@ export type UserPoolMessageConfiguration = {
   usernameAttributes?: string[];
 };
 
-export const doesConfigurationIncludeSMS = (request: ServiceQuestionsResult): boolean => {
+export const doesConfigurationIncludeSMS = (request: CognitoConfiguration | ServiceQuestionHeadlessResult): boolean => {
   if ((request.mfaConfiguration === 'OPTIONAL' || request.mfaConfiguration === 'ON') && request.mfaTypes?.includes('SMS Text Message')) {
     return true;
   }
@@ -26,14 +27,18 @@ export const doesConfigurationIncludeSMS = (request: ServiceQuestionsResult): bo
 };
 
 const getProviderPlugin = (context: $TSContext): ProviderUtils => {
-  const serviceMetaData = getSupportedServices().Cognito;
+  const serviceMetaData = supportedServices.Cognito;
   const { provider } = serviceMetaData;
 
   return context.amplify.getPluginInstance(context, provider);
 };
-export const loadResourceParameters = (context: $TSContext, resourceName: string): UserPoolMessageConfiguration => {
-  const providerPlugin = getProviderPlugin(context);
-  return providerPlugin.loadResourceParameters(context, 'auth', resourceName) as ServiceQuestionsResult;
+export const loadResourceParameters = async (context: $TSContext, resourceName: string): Promise<UserPoolMessageConfiguration> => {
+  const cliState = new AuthInputState(resourceName);
+  const userPoolMessageConfig = (await cliState.loadResourceParameters(
+    context,
+    cliState.getCLIInputPayload(),
+  )) as UserPoolMessageConfiguration;
+  return userPoolMessageConfig;
 };
 
 export const loadImportedAuthParameters = async (context: $TSContext, userPoolName: string): Promise<UserPoolMessageConfiguration> => {
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/check-for-auth-migration.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/check-for-auth-migration.ts
new file mode 100644
index 00000000000..64cf71c3385
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/check-for-auth-migration.ts
@@ -0,0 +1,21 @@
+import { $TSContext } from 'amplify-cli-core';
+import { printer, prompter } from 'amplify-prompts';
+import { AuthInputState } from '../auth-inputs-manager/auth-input-state';
+import { generateAuthStackTemplate } from './generate-auth-stack-template';
+import { migrateResourceToSupportOverride } from './migrate-override-resource';
+
+export const checkAuthResourceMigration = async (context: $TSContext, authName: string) => {
+  const cliState = new AuthInputState(authName);
+  if (!cliState.cliInputFileExists()) {
+    printer.debug('Cli-inputs.json doesnt exist');
+    // put spinner here
+    const isMigrate = await prompter.confirmContinue(`Do you want to migrate this ${authName} to support overrides?`);
+    if (isMigrate) {
+      // generate cli-inputs for migration from parameters.json
+      await migrateResourceToSupportOverride(authName);
+      // fetch cli Inputs again
+      const cliInputs = cliState.getCLIInputPayload();
+      await generateAuthStackTemplate(context, cliInputs.cognitoConfig.resourceName);
+    }
+  }
+};
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/generate-auth-stack-template.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/generate-auth-stack-template.ts
new file mode 100644
index 00000000000..ef80043a3b7
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/generate-auth-stack-template.ts
@@ -0,0 +1,7 @@
+import { AmplifyAuthTransform } from '../auth-stack-builder/auth-stack-transform';
+import { $TSContext, Template } from 'amplify-cli-core';
+
+export const generateAuthStackTemplate = async (context: $TSContext, resourceName: string): Promise<Template> => {
+  const authTransform = new AmplifyAuthTransform(resourceName);
+  return await authTransform.transform(context);
+};
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/generate-auth-trigger-template.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/generate-auth-trigger-template.ts
index 3ba1daaddf4..ee50474ef99 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/generate-auth-trigger-template.ts
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/generate-auth-trigger-template.ts
@@ -1,12 +1,11 @@
 import * as path from 'path';
 import * as fs from 'fs-extra';
-import { $TSContext, JSONUtilities, pathManager } from 'amplify-cli-core';
+import { JSONUtilities, pathManager } from 'amplify-cli-core';
 import * as iam from '@aws-cdk/aws-iam';
 import * as lambda from '@aws-cdk/aws-lambda';
 import * as cdk from '@aws-cdk/core';
 import { prepareApp } from '@aws-cdk/core/lib/private/prepare-app';
-import { AuthTriggerConnection, ServiceQuestionsResult } from '../service-walkthrough-types';
-import { CustomResource } from '@aws-cdk/core';
+import { AuthTriggerConnection, CognitoStackOptions } from '../service-walkthrough-types/cognito-user-input-types';
 import { authTriggerAssetFilePath } from '../constants';
 
 type CustomResourceAuthStackProps = Readonly<{
@@ -48,7 +47,7 @@ export class CustomResourceAuthStack extends cdk.Stack {
       config.lambdaFunctionArn = fnArn.valueAsString;
     });
 
-    createCustomResource(this, props.authTriggerConnections, userpoolId, userpoolArn);
+    createCustomResource(this, props.authTriggerConnections, userpoolId);
   }
 
   toCloudFormation() {
@@ -57,13 +56,13 @@ export class CustomResourceAuthStack extends cdk.Stack {
   }
 }
 
-export async function generateNestedAuthTriggerTemplate(context: $TSContext, category: string, request: ServiceQuestionsResult) {
+export async function generateNestedAuthTriggerTemplate(category: string, resourceName: string, request: CognitoStackOptions) {
   const cfnFileName = 'auth-trigger-cloudformation-template.json';
-  const targetDir = path.join(pathManager.getBackendDirPath(), category, request.resourceName!);
+  const targetDir = path.join(pathManager.getBackendDirPath(), category, resourceName, 'build');
   const authTriggerCfnFilePath = path.join(targetDir, cfnFileName);
   const { authTriggerConnections } = request;
   if (authTriggerConnections) {
-    const cfnObject = await createCustomResourceforAuthTrigger(context, JSON.parse(authTriggerConnections));
+    const cfnObject = await createCustomResourceforAuthTrigger(authTriggerConnections);
     JSONUtilities.writeJson(authTriggerCfnFilePath, cfnObject);
   } else {
     // delete the custom stack template if the triggers arent defined
@@ -75,7 +74,7 @@ export async function generateNestedAuthTriggerTemplate(context: $TSContext, cat
   }
 }
 
-async function createCustomResourceforAuthTrigger(context: any, authTriggerConnections: AuthTriggerConnection[]) {
+async function createCustomResourceforAuthTrigger(authTriggerConnections: AuthTriggerConnection[]) {
   const stack = new CustomResourceAuthStack(undefined as any, 'Amplify', {
     description: 'Custom Resource stack for Auth Trigger created using Amplify CLI',
     authTriggerConnections: authTriggerConnections,
@@ -84,31 +83,24 @@ async function createCustomResourceforAuthTrigger(context: any, authTriggerConne
   return cfn;
 }
 
-function createCustomResource(
-  stack: cdk.Stack,
-  authTriggerConnections: AuthTriggerConnection[],
-  userpoolId: cdk.CfnParameter,
-  userpoolArn: cdk.CfnParameter,
-) {
+function createCustomResource(stack: cdk.Stack, authTriggerConnections: AuthTriggerConnection[], userpoolId: cdk.CfnParameter) {
   const triggerCode = fs.readFileSync(authTriggerAssetFilePath, 'utf-8');
   const authTriggerFn = new lambda.Function(stack, 'authTriggerFn', {
     runtime: lambda.Runtime.NODEJS_12_X,
     code: lambda.Code.fromInline(triggerCode),
     handler: 'index.handler',
   });
-  // reason to add iam::PassRole
-  //AccessDeniedException: User: arn:aws:sts::<ACCOUNT_ID>:assumed-role/amplify-emailcheck-dev-17-authTriggerFnServiceRole-1JAJZTK0HHAHP/amplify-emailcheck-dev-17374-authTriggerFn7FCFA449-SP7WeFmC9mD1 is not authorized to perform: iam:PassRole on resource: arn:aws:iam::ACCOUNT_ID:role/sns533b49c5173740-dev
   if (authTriggerFn.role) {
     authTriggerFn.role.addToPrincipalPolicy(
       new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,
-        actions: ['cognito-idp:DescribeUserPool', 'cognito-idp:DescribeUserPoolClient', 'cognito-idp:UpdateUserPool', 'iam:PassRole'],
+        actions: ['cognito-idp:DescribeUserPoolClient', 'cognito-idp:UpdateUserPool'],
         resources: ['*'],
       }),
     );
   }
   // The custom resource that uses the provider to supply value
-  new CustomResource(stack, 'CustomAuthTriggerResource', {
+  new cdk.CustomResource(stack, 'CustomAuthTriggerResource', {
     serviceToken: authTriggerFn.functionArn,
     properties: { userpoolId: userpoolId.valueAsString, lambdaConfig: authTriggerConnections },
     resourceType: 'Custom::CustomAuthTriggerResourceOutputs',
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/generate-user-pool-group-stack-template.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/generate-user-pool-group-stack-template.ts
new file mode 100644
index 00000000000..6b486efbe02
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/generate-user-pool-group-stack-template.ts
@@ -0,0 +1,12 @@
+import { $TSContext } from 'amplify-cli-core';
+import { Template } from 'cloudform-types';
+import { AmplifyUserPoolGroupTransform } from '../auth-stack-builder/user-pool-group-stack-transform';
+
+export const generateUserPoolGroupStackTemplate = async (context: $TSContext, resourceName: string): Promise<Template> => {
+  try {
+    const userPoolTransform = new AmplifyUserPoolGroupTransform(resourceName);
+    return await userPoolTransform.transform(context);
+  } catch (e) {
+    throw new Error(e);
+  }
+};
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/message-printer.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/message-printer.ts
index b5c0c0148a8..a924af0a535 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/message-printer.ts
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/message-printer.ts
@@ -1,12 +1,13 @@
 import { EOL } from 'os';
 import { BannerMessage } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
 
 /**
  * A factory function that returns a function that prints the "success message" after adding auth
  * @param print The amplify print object
  */
 export const getPostAddAuthMessagePrinter = (print: any) => (resourceName: string) => {
-  print.success(`Successfully added auth resource ${resourceName} locally`);
+  printer.success(`Successfully added auth resource ${resourceName} locally`);
   printCommonText(print);
 };
 
@@ -15,23 +16,23 @@ export const getPostAddAuthMessagePrinter = (print: any) => (resourceName: strin
  * @param context The amplify print object
  */
 export const getPostUpdateAuthMessagePrinter = (print: any) => (resourceName: string) => {
-  print.success(`Successfully updated auth resource ${resourceName} locally`);
+  printer.success(`Successfully updated auth resource ${resourceName} locally`);
   printCommonText(print);
 };
 
 const printCommonText = (print: any) => {
-  print.info('');
-  print.success('Some next steps:');
-  print.info('"amplify push" will build all your local backend resources and provision it in the cloud');
-  print.info(
+  printer.blankLine();
+  printer.success('Some next steps:');
+  printer.info('"amplify push" will build all your local backend resources and provision it in the cloud');
+  printer.info(
     '"amplify publish" will build all your local backend and frontend resources (if you have hosting category added) and provision it in the cloud',
   );
-  print.info('');
+  printer.blankLine();
 };
 
-export const printSMSSandboxWarning = async (print: any) => {
+export const printSMSSandboxWarning = async () => {
   const postAddUpdateSMSSandboxInfo = await BannerMessage.getMessage('COGNITO_SMS_SANDBOX_CATEGORY_AUTH_ADD_OR_UPDATE_INFO');
   if (postAddUpdateSMSSandboxInfo) {
-    print.warning(`${postAddUpdateSMSSandboxInfo}${EOL}`);
+    printer.warn(`${postAddUpdateSMSSandboxInfo}${EOL}`);
   }
 };
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/migrate-override-resource.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/migrate-override-resource.ts
new file mode 100644
index 00000000000..cbde6d2f354
--- /dev/null
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/migrate-override-resource.ts
@@ -0,0 +1,190 @@
+import { $TSObject, JSONUtilities, NotInitializedError, pathManager } from 'amplify-cli-core';
+import { printer } from 'amplify-prompts';
+import * as path from 'path';
+import uuid from 'uuid';
+import * as fs from 'fs-extra';
+import _ from 'lodash';
+import {
+  CognitoCLIInputs,
+  CognitoConfiguration,
+  MfaResult,
+  ServiceQuestionsBaseResult,
+  OAuthResult,
+  SocialProviderResult,
+  IdentityPoolResult,
+  PasswordRecoveryResult,
+  AdminQueriesResult,
+  PasswordPolicyResult,
+} from '../service-walkthrough-types/awsCognito-user-input-types';
+
+export const migrateResourceToSupportOverride = async (resourceName: string) => {
+  printer.info('Starting Migration Process');
+  /**
+   * backup resource folder
+   * get parameters.json
+   * generate and save cliInputs
+   * return cliInputs
+   *  */
+  const projectPath = pathManager.findProjectRoot();
+  if (!projectPath) {
+    // New project, hence not able to find the amplify dir
+    throw new NotInitializedError();
+  }
+  const authresourceDirPath = path.join(pathManager.getBackendDirPath(), 'auth', resourceName);
+  const userPoolGroupResourceDirPath = path.join(pathManager.getBackendDirPath(), 'auth', 'UserPoolGroups');
+  const backupAuthResourceFolder = backup(authresourceDirPath, projectPath, resourceName);
+  const backupUserPoolGroupResourceFolder = backup(userPoolGroupResourceDirPath, projectPath, 'UserPoolGroups');
+
+  try {
+    const parameters = JSONUtilities.readJson<$TSObject>(path.join(authresourceDirPath, 'parameters.json'), { throwIfNotExist: true });
+    fs.emptyDirSync(authresourceDirPath);
+    // remomve UserPool Resource
+    if (parameters?.userPoolGroupList?.length > 0) {
+      fs.unlinkSync(path.join(userPoolGroupResourceDirPath, 'template.json'));
+      fs.unlinkSync(path.join(userPoolGroupResourceDirPath, 'parameters.json'));
+    }
+
+    // convert parameters.json to cli-inputs.json
+    const cliInputs = mapParametersJsonToCliInputs(parameters!);
+    const cliInputsPath = path.join(authresourceDirPath, 'cli-inputs.json');
+    JSONUtilities.writeJson(cliInputsPath, cliInputs);
+    printer.success('Migration is Successful');
+  } catch (e) {
+    printer.error('There was an error migrating your project.');
+    rollback(authresourceDirPath, backupAuthResourceFolder!);
+    rollback(userPoolGroupResourceDirPath, backupUserPoolGroupResourceFolder!);
+    printer.info('migration operations are rolled back.');
+    throw e;
+  } finally {
+    cleanUp(backupAuthResourceFolder);
+    cleanUp(backupUserPoolGroupResourceFolder);
+  }
+};
+
+function backup(authresourcePath: string, projectPath: string, resourceName: string) {
+  if (fs.existsSync(authresourcePath)) {
+    const backupauthResourceDirName = `${resourceName}-BACKUP-${uuid().split('-')[0]}`;
+    const backupauthResourceDirPath = path.join(projectPath, backupauthResourceDirName);
+
+    if (fs.existsSync(backupauthResourceDirPath)) {
+      const error = new Error(`Backup folder at ${backupauthResourceDirPath} already exists, remove the folder and retry the operation.`);
+
+      error.name = 'BackupFolderAlreadyExist';
+      error.stack = undefined;
+
+      throw error;
+    }
+
+    fs.copySync(authresourcePath, backupauthResourceDirPath);
+    return backupauthResourceDirPath;
+  }
+}
+
+function rollback(authresourcePath: string, backupauthResourceDirPath: string) {
+  if (fs.existsSync(authresourcePath) && fs.existsSync(backupauthResourceDirPath)) {
+    fs.removeSync(authresourcePath);
+    fs.moveSync(backupauthResourceDirPath, authresourcePath);
+  }
+}
+
+function cleanUp(authresourcePath: string | undefined) {
+  if (!!authresourcePath && fs.existsSync(authresourcePath)) fs.removeSync(authresourcePath);
+}
+
+const mapParametersJsonToCliInputs = (parameters: $TSObject): CognitoCLIInputs => {
+  const baseResult: ServiceQuestionsBaseResult = {
+    authSelections: parameters.authSelections,
+    requiredAttributes: parameters.requiredAttributes,
+    resourceName: parameters.resourceName,
+    serviceName: parameters.serviceName,
+    useDefault: parameters.useDefault,
+    userpoolClientReadAttributes: parameters.userpoolClientReadAttributes,
+    userpoolClientWriteAttributes: parameters.userpoolClientWriteAttributes,
+    aliasAttributes: parameters.aliasAttributes,
+    resourceNameTruncated: parameters.resourceNameTruncated,
+    sharedId: parameters.sharedId,
+    updateFlow: parameters.updateFlow,
+    userPoolGroupList: parameters.userPoolGroupList,
+    userPoolGroups: parameters.userPoolGroups,
+    userPoolName: parameters.userPoolName,
+    usernameAttributes: parameters.usernameAttributes,
+    usernameCaseSensitive: parameters.usernameCaseSensitive,
+    userpoolClientRefreshTokenValidity: parameters.userpoolClientRefreshTokenValidity,
+    userpoolClientSetAttributes: parameters.userpoolClientSetAttributes,
+    verificationBucketName: parameters.verificationBucketName,
+    userpoolClientGenerateSecret: parameters.userpoolClientGenerateSecret,
+    userpoolClientLambdaRole: parameters.userpoolClientLambdaRole,
+  };
+
+  const oAuthResult: OAuthResult = {
+    hostedUI: parameters.hostedUI,
+    hostedUIDomainName: parameters.hostedUIDomainName,
+    hostedUIProviderMeta: parameters.hostedUIProviderMeta,
+    oAuthMetadata: parameters.oAuthMetadata,
+  };
+
+  const socialProviderResult: SocialProviderResult = {
+    authProvidersUserPool: parameters.authProvidersUserPool,
+  };
+
+  const identityPoolResult: IdentityPoolResult = {
+    thirdPartyAuth: parameters.thirdPartyAuth,
+    identityPoolName: parameters.identityPoolName,
+    allowUnauthenticatedIdentities: parameters.allowUnauthenticatedIdentities,
+    authProviders: parameters.authProviders,
+    googleClientId: parameters.googleClientId,
+    googleIos: parameters.googleIos,
+    googleAndroid: parameters.googleAndroid,
+    facebookAppId: parameters.facebookAppId,
+    amazonAppId: parameters.amazonAppId,
+    appleAppId: parameters.appleAppId,
+    selectedParties: parameters.selectedParties,
+    audiences: parameters.audiences,
+  };
+
+  const passwordRecoveryResult: PasswordRecoveryResult = {
+    emailVerificationMessage: parameters.emailVerificationMessage,
+    emailVerificationSubject: parameters.emailVerificationSubject,
+    smsVerificationMessage: parameters.smsVerificationMessage,
+    autoVerifiedAttributes: parameters.autoVerifiedAttributes,
+  };
+
+  const mfaResult: MfaResult = {
+    mfaConfiguration: parameters.mfaConfiguration,
+    mfaTypes: parameters.mfaTypes,
+    smsAuthenticationMessage: parameters.smsAuthenticationMessage,
+  };
+
+  const adminQueriesResult: AdminQueriesResult = {
+    adminQueries: parameters.adminQueries,
+    adminQueryGroup: parameters.adminQueryGroup,
+  };
+
+  const passwordPolicyResult: PasswordPolicyResult = {
+    passwordPolicyCharacters: parameters.passwordPolicyCharacters,
+    passwordPolicyMinLength: parameters.passwordPolicyMinLength,
+  };
+
+  const cliInputs: CognitoConfiguration = {
+    ...baseResult,
+    ...passwordPolicyResult,
+    ...adminQueriesResult,
+    ...mfaResult,
+    ...passwordRecoveryResult,
+    ...oAuthResult,
+    ...socialProviderResult,
+    ...identityPoolResult,
+  };
+
+  if (parameters.triggers) {
+    cliInputs.triggers = JSON.parse(parameters.triggers);
+  }
+
+  // removing undefined values
+  const filteredCliInputs = _.pickBy(cliInputs, v => v !== undefined) as CognitoConfiguration;
+
+  return {
+    version: '1',
+    cognitoConfig: filteredCliInputs,
+  };
+};
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/synthesize-resources.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/synthesize-resources.ts
index 18b5ded7759..1ae21e59679 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/synthesize-resources.ts
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/synthesize-resources.ts
@@ -1,40 +1,34 @@
-import { AuthTriggerConfig, AuthTriggerConnection, ServiceQuestionsResult } from '../service-walkthrough-types';
+import { AuthTriggerConfig, AuthTriggerConnection } from '../service-walkthrough-types/cognito-user-input-types';
 import * as path from 'path';
 import { existsSync, copySync, outputFileSync } from 'fs-extra';
 import uuid from 'uuid';
-import { cfnTemplateRoot, privateKeys, adminAuthAssetRoot, triggerRoot, ENV_SPECIFIC_PARAMS } from '../constants';
-import { pathManager, JSONUtilities, FeatureFlags } from 'amplify-cli-core';
+import { cfnTemplateRoot, privateKeys, adminAuthAssetRoot, triggerRoot } from '../constants';
+import { pathManager, JSONUtilities, FeatureFlags, $TSAny } from 'amplify-cli-core';
 import { get } from 'lodash';
-import { authProviders } from '../assets/string-maps';
-import { generateNestedAuthTriggerTemplate } from './generate-auth-trigger-template';
-
-const category = 'auth';
+import { generateUserPoolGroupStackTemplate } from './generate-user-pool-group-stack-template';
+import { CognitoConfiguration } from '../service-walkthrough-types/awsCognito-user-input-types';
 
 // keep in sync with ServiceName in amplify-category-function, but probably it will not change
 const FunctionServiceNameLambdaFunction = 'Lambda';
 
 /**
- * Factory function that returns a function that synthesizes all resources based on a ServiceQuestionsResult request.
+ * Factory function that returns a function that synthesizes all resources based on a CognitoCLIInputs request.
  * The function returns the request unchanged to enable .then() chaining
  * @param context The amplify context
  * @param cfnFilename The template CFN filename
  * @param provider The cloud provider name
  */
-export const getResourceSynthesizer = (context: any, cfnFilename: string, provider: string) => async (
-  request: Readonly<ServiceQuestionsResult>,
-) => {
+export const getResourceSynthesizer = async (context: any, request: Readonly<CognitoConfiguration>) => {
   await lambdaTriggers(request, context, null);
-  await createUserPoolGroups(context, request.resourceName!, request.userPoolGroupList);
+  // transformation handled in api and functions.
   await addAdminAuth(context, request.resourceName!, 'add', request.adminQueryGroup);
-  await copyCfnTemplate(context, category, request, cfnFilename);
-  await generateNestedAuthTriggerTemplate(context, category, request);
-  saveResourceParameters(context, provider, category, request.resourceName!, request, ENV_SPECIFIC_PARAMS);
+  // copy custom-message trigger files in to S3
   await copyS3Assets(request);
   return request;
 };
 
 /**
- * Factory function that returns a function that updates the auth resource based on a ServiceQuestionsResult request.
+ * Factory function that returns a function that updates the auth resource based on a CognitoCLIInputs request.
  * The function returns the request unchanged to enable .then() chaining
  *
  * The code is more-or-less refactored as-is from the existing update logic
@@ -42,13 +36,8 @@ export const getResourceSynthesizer = (context: any, cfnFilename: string, provid
  * @param cfnFilename The template CFN filename
  * @param provider The cloud provider name
  */
-export const getResourceUpdater = (context: any, cfnFilename: string, provider: string) => async (request: ServiceQuestionsResult) => {
+export const getResourceUpdater = async (context: $TSAny, request: Readonly<CognitoConfiguration>) => {
   const resources = context.amplify.getProjectMeta();
-  if (resources.auth.userPoolGroups) {
-    await updateUserPoolGroups(context, request.resourceName!, request.userPoolGroupList);
-  } else {
-    await createUserPoolGroups(context, request.resourceName!, request.userPoolGroupList);
-  }
 
   const adminQueriesFunctionName = get<{ category: string; resourceName: string }[]>(resources, ['api', 'AdminQueries', 'dependsOn'], [])
     .filter(resource => resource.category === 'function')
@@ -60,38 +49,10 @@ export const getResourceUpdater = (context: any, cfnFilename: string, provider:
     await addAdminAuth(context, request.resourceName!, 'add', request.adminQueryGroup);
   }
 
-  const providerPlugin = context.amplify.getPluginInstance(context, provider);
-  const previouslySaved = providerPlugin.loadResourceParameters(context, 'auth', request.resourceName).triggers || '{}';
-  await lambdaTriggers(request, context, JSON.parse(previouslySaved));
-
-  if ((!request.updateFlow && !request.thirdPartyAuth) || (request.updateFlow === 'manual' && !request.thirdPartyAuth)) {
-    delete request.selectedParties;
-    request.authProviders = [];
-    authProviders.forEach(a => delete (request as any)[a.answerHashKey]);
-    if (request.googleIos) {
-      delete request.googleIos;
-    }
-    if (request.googleAndroid) {
-      delete request.googleAndroid;
-    }
-    if (request.audiences) {
-      delete request.audiences;
-    }
-  }
-
-  if (request.useDefault === 'default' || request.hostedUI === false) {
-    delete request.oAuthMetadata;
-    delete request.hostedUIProviderMeta;
-    delete request.hostedUIProviderCreds;
-    delete request.hostedUIDomainName;
-    delete request.authProvidersUserPool;
-  }
+  const previouslySaved =
+    typeof context.updatingAuth.triggers === 'string' ? JSON.parse(context.updatingAuth.triggers) : context.updatingAuth.triggers;
+  await lambdaTriggers(request, context, previouslySaved);
 
-  if (request.updateFlow !== 'updateUserPoolGroups' && request.updateFlow !== 'updateAdminQueries') {
-    await copyCfnTemplate(context, category, request, cfnFilename);
-    await generateNestedAuthTriggerTemplate(context, category, request);
-    saveResourceParameters(context, provider, category, request.resourceName!, request, ENV_SPECIFIC_PARAMS);
-  }
   await copyS3Assets(request);
   return request;
 };
@@ -203,7 +164,7 @@ const lambdaTriggers = async (coreAnswers: any, context: any, previouslySaved: a
   coreAnswers.dependsOn = context.amplify.dependsOnBlock(context, dependsOnKeys, 'Cognito');
 };
 
-const createUserPoolGroups = async (context: any, resourceName: string, userPoolGroupList?: string[]) => {
+export const createUserPoolGroups = async (context: any, resourceName: string, userPoolGroupList?: string[]) => {
   if (userPoolGroupList && userPoolGroupList.length > 0) {
     const userPoolGroupPrecedenceList = [];
 
@@ -216,7 +177,7 @@ const createUserPoolGroups = async (context: any, resourceName: string, userPool
 
     const userPoolGroupFile = path.join(pathManager.getBackendDirPath(), 'auth', 'userPoolGroups', 'user-pool-group-precedence.json');
 
-    const userPoolGroupParams = path.join(pathManager.getBackendDirPath(), 'auth', 'userPoolGroups', 'parameters.json');
+    const userPoolGroupParams = path.join(pathManager.getBackendDirPath(), 'auth', 'userPoolGroups', 'build', 'parameters.json');
 
     /* eslint-disable */
     const groupParams = {
@@ -243,10 +204,12 @@ const createUserPoolGroups = async (context: any, resourceName: string, userPool
         },
       ],
     });
+    // create CFN
+    await generateUserPoolGroupStackTemplate(context, resourceName);
   }
 };
 
-const updateUserPoolGroups = async (context: any, resourceName: string, userPoolGroupList?: string[]) => {
+export const updateUserPoolGroups = async (context: any, resourceName: string, userPoolGroupList?: string[]) => {
   if (userPoolGroupList && userPoolGroupList.length > 0) {
     const userPoolGroupPrecedenceList = [];
 
@@ -277,6 +240,8 @@ const updateUserPoolGroups = async (context: any, resourceName: string, userPool
         },
       ],
     });
+    // generate template
+    await generateUserPoolGroupStackTemplate(context, resourceName);
   }
 };
 
@@ -430,7 +395,7 @@ const createAdminAuthAPI = async (context: any, authResourceName: string, functi
   }
 };
 
-const copyS3Assets = async (request: ServiceQuestionsResult) => {
+const copyS3Assets = async (request: CognitoConfiguration) => {
   const targetDir = path.join(pathManager.getBackendDirPath(), 'auth', request.resourceName!, 'assets');
   const triggers = request.triggers ? JSONUtilities.parse<any>(request.triggers) : null;
   const confirmationFileNeeded = request.triggers && triggers.CustomMessage && triggers.CustomMessage.includes('verification-link');
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/transform-user-pool-group.js b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/transform-user-pool-group.js
index 0c35daadd80..d2712bde9e2 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/transform-user-pool-group.js
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/transform-user-pool-group.js
@@ -1,6 +1,7 @@
 const path = require('path');
 const fs = require('fs');
-const { cfnTemplateRoot } = require('../constants');
+const { generateUserPoolGroupStackTemplate } = require('./generate-user-pool-group-stack-template');
+const { AuthInputState } = require('../auth-inputs-manager/auth-input-state');
 
 async function transformUserPoolGroupSchema(context) {
   const resourceDirPath = path.join(
@@ -41,38 +42,16 @@ async function transformUserPoolGroupSchema(context) {
     }
   });
 
-  const copyJobs = [
-    {
-      dir: cfnTemplateRoot,
-      template: 'user-pool-group-template.json.ejs',
-      target: path.join(context.amplify.pathManager.getBackendDirPath(), 'auth', 'userPoolGroups', 'template.json'),
-    },
-  ];
-
-  const authResourceParameters = loadResourceParameters(context, authResourceName);
-
+  // validating cli-inputs
+  const cliState = new AuthInputState(authResourceName);
+  const identityPoolName = cliState.getCLIInputPayload().identityPoolName;
   const props = {
     groups,
     cognitoResourceName: authResourceName,
-    identityPoolName: authResourceParameters.identityPoolName,
+    identityPoolName: identityPoolName,
   };
 
-  await context.amplify.copyBatch(context, copyJobs, props, true);
-}
-
-function loadResourceParameters(context, authResourceName) {
-  let parameters = {};
-  let category = 'auth';
-  const backendDirPath = context.amplify.pathManager.getBackendDirPath();
-  const resourceDirPath = path.join(backendDirPath, category, authResourceName);
-  const parametersFilePath = path.join(resourceDirPath, 'parameters.json');
-  if (fs.existsSync(parametersFilePath)) {
-    parameters = context.amplify.readJsonFile(parametersFilePath);
-  } else {
-    throw new Error('Auth resource missing parameters file');
-  }
-
-  return parameters;
+  await generateUserPoolGroupStackTemplate(props);
 }
 
 module.exports = {
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/trigger-file-uploader.js b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/trigger-file-uploader.js
index 054d0165ed5..2dc8e8434b0 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/trigger-file-uploader.js
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/trigger-file-uploader.js
@@ -24,7 +24,7 @@ async function uploadFiles(context) {
     }
     const assetPath = `${authPath}/assets`;
     const env = context.amplify.getEnvInfo().envName;
-    const bucketName = `${context.amplify.readJsonFile(`${authPath}/parameters.json`).verificationBucketName}-${env}`;
+    const bucketName = `${context.amplify.readJsonFile(`${authPath}/build/parameters.json`).verificationBucketName}-${env}`;
 
     if (!existsSync(assetPath)) {
       return null;
diff --git a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/verification-bucket-name.ts b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/verification-bucket-name.ts
index 6d7fa9c73e8..ff4a89720f9 100644
--- a/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/verification-bucket-name.ts
+++ b/packages/amplify-category-auth/src/provider-utils/awscloudformation/utils/verification-bucket-name.ts
@@ -1,6 +1,6 @@
 /**
  * Refactored from awscloudformation/index.js
- * @param current The current ServiceQuestionsResult
+ * @param current The current CognitoCLIInputs
  * @param previous Previous results (if any)
  */
 export const verificationBucketName = async (current: any, previous?: any) => {
diff --git a/packages/amplify-category-auth/src/provider-utils/supported-services.ts b/packages/amplify-category-auth/src/provider-utils/supported-services.ts
index 78bcc262c76..fbf817195a6 100644
--- a/packages/amplify-category-auth/src/provider-utils/supported-services.ts
+++ b/packages/amplify-category-auth/src/provider-utils/supported-services.ts
@@ -1,6 +1,4 @@
-import { $TSAny, FeatureFlags } from 'amplify-cli-core';
-
-const supportedServices = {
+export const supportedServices = {
   Cognito: {
     inputs: [
       {
@@ -285,27 +283,6 @@ const supportedServices = {
           },
         ],
       },
-      {
-        key: 'usernameAttributes',
-        question: 'How do you want users to be able to sign in?',
-        required: true,
-        type: 'list',
-        map: 'signInOptions',
-        prefixColor: 'red',
-        prefix: 'Warning: you will not be able to edit these selections.',
-        learnMore:
-          "Selecting 'Email' and/or 'Phone Number' will allow end users to sign-up using these values.  Selecting 'Username' will require a unique username for users.",
-        andConditions: [
-          {
-            key: 'authSelections',
-            value: 'identityPoolOnly',
-            operator: '!=',
-          },
-          {
-            preventEdit: 'always',
-          },
-        ],
-      },
       {
         key: 'aliasAttributes',
         question: 'How do you want users to be able to sign in?',
@@ -1258,13 +1235,3 @@ const supportedServices = {
     provider: 'awscloudformation',
   },
 };
-export const getSupportedServices = (): $TSAny => {
-  const keyToRemove = FeatureFlags.getBoolean('auth.forceAliasAttributes') ? 'usernameAttributes' : 'aliasAttributes';
-  const inputs = supportedServices.Cognito.inputs.filter(input => input.key !== keyToRemove);
-  return {
-    Cognito: {
-      ...supportedServices.Cognito,
-      inputs,
-    },
-  };
-};
diff --git a/packages/amplify-category-auth/src/utils/getAuthResourceName.js b/packages/amplify-category-auth/src/utils/getAuthResourceName.ts
similarity index 58%
rename from packages/amplify-category-auth/src/utils/getAuthResourceName.js
rename to packages/amplify-category-auth/src/utils/getAuthResourceName.ts
index ccf29824aae..76717057d24 100644
--- a/packages/amplify-category-auth/src/utils/getAuthResourceName.js
+++ b/packages/amplify-category-auth/src/utils/getAuthResourceName.ts
@@ -1,6 +1,8 @@
-async function getAuthResourceName(context) {
+import { $TSContext } from 'amplify-cli-core';
+
+export const getAuthResourceName = async (context: $TSContext) => {
   const { allResources } = await context.amplify.getResourceStatus();
-  const authResource = allResources.filter(resource => resource.service === 'Cognito');
+  const authResource = allResources.filter((resource: { service: string }) => resource.service === 'Cognito');
   let authResourceName;
 
   if (authResource.length > 0) {
@@ -10,8 +12,4 @@ async function getAuthResourceName(context) {
     throw new Error('Cognito UserPool does not exists');
   }
   return authResourceName;
-}
-
-module.exports = {
-  getAuthResourceName,
 };
diff --git a/packages/amplify-category-auth/tsconfig.json b/packages/amplify-category-auth/tsconfig.json
index b1f1386c6df..eff2879c722 100644
--- a/packages/amplify-category-auth/tsconfig.json
+++ b/packages/amplify-category-auth/tsconfig.json
@@ -3,12 +3,15 @@
   "compilerOptions": {
     "outDir": "lib",
     "rootDir": "src",
-    "allowJs": true
+    "allowJs": true,
+    "strictPropertyInitialization": false,
+    "inlineSources": true
   },
   "exclude": [
     "coverage",
     "lib",
     "resources",
+    "scripts",
     "provider-utils/awscloudformation/triggers",
     "src/__tests__",
   ],
diff --git a/packages/amplify-cli-core/src/category-interfaces/category-override-base.ts b/packages/amplify-cli-core/src/category-interfaces/category-override-base.ts
index 58f40effbdf..130482bccd1 100644
--- a/packages/amplify-cli-core/src/category-interfaces/category-override-base.ts
+++ b/packages/amplify-cli-core/src/category-interfaces/category-override-base.ts
@@ -2,9 +2,9 @@ import { $TSContext } from '..';
 import { Template } from './amplify-base-cdk-types';
 
 export abstract class AmplifyCategoryTransform {
-  _resourceName: string;
+  resourceName: string;
   constructor(resourceName: string) {
-    this._resourceName = resourceName;
+    this.resourceName = resourceName;
   }
   /**
    * Entry point for CFN transformation process for a category
diff --git a/packages/amplify-cli-core/src/cliConstants.ts b/packages/amplify-cli-core/src/cliConstants.ts
index ca60614aac3..c9c29e3ce9d 100644
--- a/packages/amplify-cli-core/src/cliConstants.ts
+++ b/packages/amplify-cli-core/src/cliConstants.ts
@@ -24,6 +24,7 @@ export const AmplifySupportedService = {
   S3: 'S3',
   DYNAMODB: 'DynamoDB',
   COGNITO: 'Cognito',
+  COGNITOUSERPOOLGROUPS: 'Cognito-UserPool-Groups',
 };
 
 export const overriddenCategories = [AmplifyCategories.AUTH, AmplifyCategories.STORAGE];
diff --git a/packages/amplify-cli-core/src/index.ts b/packages/amplify-cli-core/src/index.ts
index fc553384915..4803624c4af 100644
--- a/packages/amplify-cli-core/src/index.ts
+++ b/packages/amplify-cli-core/src/index.ts
@@ -52,6 +52,7 @@ export type $TSContext = {
   newUserInfo?: $TSAny;
   filesystem: IContextFilesystem;
   template: IContextTemplate;
+  updatingAuth: $TSAny;
 };
 
 export type CategoryName = string;
@@ -310,9 +311,9 @@ interface AmplifyToolkit {
   deleteTrigger: () => $TSAny;
   deleteAllTriggers: () => $TSAny;
   deleteDeselectedTriggers: () => $TSAny;
-  dependsOnBlock: () => $TSAny;
+  dependsOnBlock: (context: $TSContext, dependsOnKeys: string[], service: string) => $TSAny;
   getTriggerMetadata: () => $TSAny;
-  getTriggerPermissions: () => $TSAny;
+  getTriggerPermissions: (context: $TSContext, triggers: any, category: string, resourceName: string) => $TSAny;
   getTriggerEnvVariables: () => $TSAny;
   getTriggerEnvInputs: () => $TSAny;
   getUserPoolGroupList: () => $TSAny[];
diff --git a/packages/amplify-cli-core/src/overrides-manager/override-skeleton-generator.ts b/packages/amplify-cli-core/src/overrides-manager/override-skeleton-generator.ts
index 213c85f5e8f..158cdec5e70 100644
--- a/packages/amplify-cli-core/src/overrides-manager/override-skeleton-generator.ts
+++ b/packages/amplify-cli-core/src/overrides-manager/override-skeleton-generator.ts
@@ -46,6 +46,10 @@ export async function buildOverrideDir(cwd: string, destDirPath: string): Promis
     });
     // run tsc build to build override.ts file
     const tsConfigDir = path.join(destDirPath, 'build');
+
+    // making sure build folder exists for resource
+    fs.ensureDirSync(tsConfigDir);
+
     const tsConfigFilePath = path.join(tsConfigDir, 'tsconfig.resource.json');
     execa.sync('tsc', [`--project`, `${tsConfigFilePath}`], {
       cwd: tsConfigDir,
@@ -80,6 +84,8 @@ export const generateAmplifyOverrideProjectBuildFiles = (backendDir: string, src
 
 export const generateTsConfigforProject = (backendDir: string, srcResourceDirPath: string, destDirPath: string) => {
   const overrideFileName = path.join(destDirPath, 'override.ts');
+  // ensure build dir path
+  fs.ensureDirSync(path.join(destDirPath, 'build'));
   const resourceTsConfigFileName = path.join(destDirPath, 'build', 'tsconfig.resource.json');
   fs.writeFileSync(overrideFileName, fs.readFileSync(path.join(srcResourceDirPath, 'override.ts')));
   fs.writeFileSync(resourceTsConfigFileName, fs.readFileSync(path.join(srcResourceDirPath, 'tsconfig.resource.json')));
diff --git a/packages/amplify-cli-core/src/state-manager/pathManager.ts b/packages/amplify-cli-core/src/state-manager/pathManager.ts
index 00a8d9d0716..7b75a1a5d2e 100644
--- a/packages/amplify-cli-core/src/state-manager/pathManager.ts
+++ b/packages/amplify-cli-core/src/state-manager/pathManager.ts
@@ -141,10 +141,10 @@ export class PathManager {
     this.constructPath(projectPath, [PathConstants.AmplifyDirName, PathConstants.BackendDirName, category, resourceName]);
 
   getResourceParametersFilePath = (projectPath: string | undefined, category: string, resourceName: string): string =>
-    path.join(this.getResourceDirectoryPath(projectPath, category, resourceName), PathConstants.ParametersJsonFileName);
+    path.join(this.getResourceDirectoryPath(projectPath, category, resourceName), 'build', PathConstants.ParametersJsonFileName);
 
   getResourceCfnTemplatePath = (projectPath: string | undefined, category: string, resourceName: string): string =>
-    path.join(this.getResourceDirectoryPath(projectPath, category, resourceName), PathConstants.CfnFileName(resourceName));
+    path.join(this.getResourceDirectoryPath(projectPath, category, resourceName), 'build', PathConstants.CfnFileName(resourceName));
 
   getReadMeFilePath = (projectPath?: string): string =>
     this.constructPath(projectPath, [PathConstants.AmplifyDirName, PathConstants.ReadMeFileName]);
diff --git a/packages/amplify-cli-overrides-helper/package.json b/packages/amplify-cli-overrides-helper/package.json
index 0add01b4871..434dee21403 100644
--- a/packages/amplify-cli-overrides-helper/package.json
+++ b/packages/amplify-cli-overrides-helper/package.json
@@ -28,7 +28,8 @@
   },
   "dependencies": {
     "amplify-prompts": "1.1.2",
-    "amplify-provider-awscloudformation": "4.60.1"
+    "amplify-provider-awscloudformation": "4.60.1",
+    "@aws-amplify/amplify-category-auth": "1.0.0"
   },
   "devDependencies": {},
   "jest": {
diff --git a/packages/amplify-cli-overrides-helper/tsconfig.json b/packages/amplify-cli-overrides-helper/tsconfig.json
index ec3ef0706fb..83af1c6a620 100644
--- a/packages/amplify-cli-overrides-helper/tsconfig.json
+++ b/packages/amplify-cli-overrides-helper/tsconfig.json
@@ -3,10 +3,10 @@
     "compilerOptions": {
       "outDir": "./lib",
       "rootDir": "./src",
-      "module": "ESNext"
     },
   "references": [
     { "path": "../amplify-provider-awscloudformation" },
+    { "path": "../amplify-category-auth" },
     ]
 }
   
\ No newline at end of file
diff --git a/packages/amplify-cli/package.json b/packages/amplify-cli/package.json
index 22b0edb4790..f224767d6a4 100644
--- a/packages/amplify-cli/package.json
+++ b/packages/amplify-cli/package.json
@@ -37,7 +37,7 @@
     "amplify-app": "3.0.12",
     "amplify-category-analytics": "2.21.21",
     "amplify-category-api": "2.31.23",
-    "amplify-category-auth": "2.38.1",
+    "@aws-amplify/amplify-category-auth": "1.0.0",
     "amplify-category-function": "2.34.7",
     "amplify-category-geo": "1.0.0",
     "amplify-category-hosting": "2.7.21",
@@ -161,11 +161,13 @@
         "type": "category",
         "packageName": "amplify-category-api"
       },
-      "auth": {
-        "name": "auth",
-        "type": "category",
-        "packageName": "amplify-category-auth"
-      },
+      "auth": [
+        {
+          "name": "auth",
+          "type": "category",
+          "packageName": "@aws-amplify/amplify-category-auth"
+        }
+      ],
       "function": {
         "name": "function",
         "type": "category",
diff --git a/packages/amplify-cli/src/__tests__/extensions/amplify-helpers/get-frontend-plugins.test.ts b/packages/amplify-cli/src/__tests__/extensions/amplify-helpers/get-frontend-plugins.test.ts
index 73799d7128b..b58cb2aaec4 100644
--- a/packages/amplify-cli/src/__tests__/extensions/amplify-helpers/get-frontend-plugins.test.ts
+++ b/packages/amplify-cli/src/__tests__/extensions/amplify-helpers/get-frontend-plugins.test.ts
@@ -18,10 +18,10 @@ describe('get-frontend-plugins', () => {
             directory: '/home/user/amplify/lib/@aws-amplify/cli/node_modules/amplify-frontend-flutter',
           },
           {
-            name: 'amplify-category-auth',
+            name: '@aws-amplify/amplify-category-auth',
             pluginType: 'category',
             pluginName: 'auth',
-            directory: '/home/user/amplify/lib/@aws-amplify/cli/node_modules/amplify-category-auth',
+            directory: '/home/user/amplify/lib/@aws-amplify/cli/node_modules/@aws-amplify/amplify-category-auth',
           },
         ],
       },
@@ -42,10 +42,10 @@ describe('get-frontend-plugins', () => {
       runtime: {
         plugins: [
           {
-            name: 'amplify-category-auth',
+            name: '@aws-amplify/amplify-category-auth',
             pluginType: 'category',
             pluginName: 'auth',
-            directory: '/home/user/amplify/lib/@aws-amplify/cli/node_modules/amplify-category-auth',
+            directory: '/home/user/amplify/lib/@aws-amplify/cli/node_modules/@aws-amplify/amplify-category-auth',
           },
         ],
       },
diff --git a/packages/amplify-cli/src/__tests__/team-provider-migrate.test.ts b/packages/amplify-cli/src/__tests__/team-provider-migrate.test.ts
index 30642a6319d..733430f8043 100644
--- a/packages/amplify-cli/src/__tests__/team-provider-migrate.test.ts
+++ b/packages/amplify-cli/src/__tests__/team-provider-migrate.test.ts
@@ -105,7 +105,7 @@ describe('test migration code', () => {
     const mockGetResourceParameterJson = jest.fn().mockReturnValue({
       authSelections: 'identityPoolAndUserPool',
     });
-    jest.setMock('amplify-category-auth', {
+    jest.setMock('@aws-amplify/amplify-category-auth', {
       externalAuthEnable: jest.fn(),
     });
 
diff --git a/packages/amplify-cli/src/__tests__/test-aborting.test.ts b/packages/amplify-cli/src/__tests__/test-aborting.test.ts
index 75587235c0e..b33cd0b3c2d 100644
--- a/packages/amplify-cli/src/__tests__/test-aborting.test.ts
+++ b/packages/amplify-cli/src/__tests__/test-aborting.test.ts
@@ -10,6 +10,7 @@ describe('test SIGINT with execute', () => {
     const mockExit = jest.fn();
 
     jest.setMock('amplify-cli-core', {
+      ...(jest.requireActual('amplify-cli-core') as {}),
       JSONUtilities: {
         readJson: jest.fn().mockReturnValue({
           name: 'cli',
diff --git a/packages/amplify-cli/src/commands/build-override.ts b/packages/amplify-cli/src/commands/build-override.ts
index 4f85a91b4bf..96975b9a8b6 100644
--- a/packages/amplify-cli/src/commands/build-override.ts
+++ b/packages/amplify-cli/src/commands/build-override.ts
@@ -1,6 +1,5 @@
 import { $TSContext, IAmplifyResource } from 'amplify-cli-core';
 import { printer } from 'amplify-prompts';
-import { Console } from 'console';
 /**
  * Command to transform CFN with overrides
  */
@@ -9,7 +8,6 @@ const subcommand = 'build-override';
 export const run = async (context: $TSContext) => {
   const categoryName = context?.input?.subCommands?.[0];
   let resourceName = context?.input?.subCommands?.[1];
-
   if (categoryName === undefined) {
     // if no category is mentioned , then defaults to all resource
     resourceName = undefined;
diff --git a/packages/amplify-cli/src/extensions/amplify-helpers/on-category-outputs-change.ts b/packages/amplify-cli/src/extensions/amplify-helpers/on-category-outputs-change.ts
index c753252e5a4..db66acd810e 100644
--- a/packages/amplify-cli/src/extensions/amplify-helpers/on-category-outputs-change.ts
+++ b/packages/amplify-cli/src/extensions/amplify-helpers/on-category-outputs-change.ts
@@ -3,7 +3,7 @@ import * as path from 'path';
 import { getResourceOutputs } from './get-resource-outputs';
 import sequential from 'promise-sequential';
 import { stateManager } from 'amplify-cli-core';
-import { AuthParameters, getFrontendConfig } from 'amplify-category-auth';
+import { AuthParameters, getFrontendConfig } from '@aws-amplify/amplify-category-auth';
 
 export async function onCategoryOutputsChange(context, cloudAmplifyMeta?, localMeta?) {
   if (!cloudAmplifyMeta) {
diff --git a/packages/amplify-cli/src/extensions/amplify-helpers/trigger-flow.ts b/packages/amplify-cli/src/extensions/amplify-helpers/trigger-flow.ts
index 519122431f0..bc8aed36cd0 100644
--- a/packages/amplify-cli/src/extensions/amplify-helpers/trigger-flow.ts
+++ b/packages/amplify-cli/src/extensions/amplify-helpers/trigger-flow.ts
@@ -134,7 +134,7 @@ export const addTrigger = async triggerOptions => {
  * {
  *  key: "PostConfirmation",
  *  values: ["add-to-group"]
- *  category: "amplify-category-auth",
+ *  category: "@aws-amplify/amplify-category-auth",
  *  context: <cli-contex-object>,
  *  functionName:"parentAuthResourcePostConfirmation",
  *  parentResource:"parentAuthResource",
@@ -229,7 +229,7 @@ export const deleteAllTriggers = async (triggers, functionName, dir, context) =>
  * @function triggerFlow
  * @param {object} context CLI context
  * @param {string} resource The provider (i.e. cognito)
- * @param {string} category The CLI category (i.e. amplify-category-auth)
+ * @param {string} category The CLI category (i.e. @aws-amplify/amplify-category-auth)
  * @param {object} previousTriggers Object representing already configured triggers
  *  @example {"PostConfirmation":["add-to-group"]}
  * @returns {object} Object with current key/value pairs for triggers and templates
@@ -320,7 +320,7 @@ export const triggerFlow = async (context, resource, category, previousTriggers
  * @function getTriggerPermissions
  * @param {object} context CLI context
  * @param {string} triggers Serialized trigger object
- * @param {string} category The CLI category (i.e. amplify-category-auth)
+ * @param {string} category The CLI category (i.e. @aws-amplify/amplify-category-auth)
  * @returns {array} Array of serialized permissions objects
  * @example ["{
  *    "policyName": "AddToGroup",
diff --git a/packages/amplify-cli/src/utils/team-provider-migrate.ts b/packages/amplify-cli/src/utils/team-provider-migrate.ts
index 404a69f7197..c5c4fbc795f 100644
--- a/packages/amplify-cli/src/utils/team-provider-migrate.ts
+++ b/packages/amplify-cli/src/utils/team-provider-migrate.ts
@@ -1,4 +1,4 @@
-import { externalAuthEnable } from 'amplify-category-auth';
+import { externalAuthEnable } from '@aws-amplify/amplify-category-auth';
 import { $TSAny, PathConstants, pathManager, stateManager } from 'amplify-cli-core';
 import chalk from 'chalk';
 import _ from 'lodash';
diff --git a/packages/amplify-cli/tsconfig.json b/packages/amplify-cli/tsconfig.json
index 749e2a141a6..d463f02e4fe 100644
--- a/packages/amplify-cli/tsconfig.json
+++ b/packages/amplify-cli/tsconfig.json
@@ -15,6 +15,7 @@
     { "path": "../amplify-prompts" },
     { "path": "../amplify-provider-awscloudformation" },
     { "path": "../amplify-util-import" },
-    { "path": "../graphql-transformer-core" }
+    { "path": "../graphql-transformer-core" },
+    { "path": "../amplify-category-auth" }
   ]
 }
diff --git a/packages/amplify-e2e-core/src/categories/auth.ts b/packages/amplify-e2e-core/src/categories/auth.ts
index de06efcae62..d9e4c625e6b 100644
--- a/packages/amplify-e2e-core/src/categories/auth.ts
+++ b/packages/amplify-e2e-core/src/categories/auth.ts
@@ -320,11 +320,11 @@ export function addAuthWithCustomTrigger(cwd: string, settings: any): Promise<vo
       .wait('Enter a comma-delimited list of disallowed email domains')
       .send('amazon.com')
       .sendCarriageReturn()
+      .wait('Successfully')
       .wait(`Do you want to edit your email-filter-denylist${settings.useInclusiveTerminology === false ? '-legacy' : ''} function now?`)
-      .sendConfirmNo()
+      .sendLine('n')
       .wait('Do you want to edit your custom function now')
-      .sendConfirmNo()
-      .wait('Successfully')
+      .sendLine('n')
       .run((err: Error) => {
         if (!err) {
           resolve();
@@ -337,7 +337,11 @@ export function addAuthWithCustomTrigger(cwd: string, settings: any): Promise<vo
 
 export function updateAuthSignInSignOutUrl(cwd: string, settings: any): Promise<void> {
   return new Promise((resolve, reject) => {
-    spawn(getCLIPath(), ['update', 'auth'], { cwd, stripColors: true })
+    const chain = spawn(getCLIPath(), ['update', 'auth'], { cwd, stripColors: true });
+    if (settings?.overrides?.category === 'auth') {
+      chain.wait(`Do you want to migrate this ${settings.overrides.resourceName} to support overrides?`).send('y');
+    }
+    chain
       .wait('What do you want to do?')
       .send(KEY_DOWN_ARROW)
       .send(KEY_DOWN_ARROW)
@@ -371,7 +375,11 @@ export function updateAuthSignInSignOutUrl(cwd: string, settings: any): Promise<
 
 export function updateAuthToRemoveFederation(cwd: string, settings: any): Promise<void> {
   return new Promise((resolve, reject) => {
-    spawn(getCLIPath(), ['update', 'auth'], { cwd, stripColors: true })
+    const chain = spawn(getCLIPath(), ['update', 'auth'], { cwd, stripColors: true });
+    if (settings?.overrides?.category === 'auth') {
+      chain.wait(`Do you want to migrate this ${settings.overrides.resourceName} to support overrides?`).send('y');
+    }
+    chain
       .wait('What do you want to do?')
       .sendCarriageReturn()
       .wait('"amplify publish" will build all your local backend and frontend resources')
@@ -388,7 +396,11 @@ export function updateAuthToRemoveFederation(cwd: string, settings: any): Promis
 
 export function updateAuthWithoutCustomTrigger(cwd: string, settings: any): Promise<void> {
   return new Promise((resolve, reject) => {
-    spawn(getCLIPath(), ['update', 'auth'], { cwd, stripColors: true })
+    const chain = spawn(getCLIPath(), ['update', 'auth'], { cwd, stripColors: true });
+    if (settings?.overrides?.category === 'auth') {
+      chain.wait(`Do you want to migrate this ${settings.overrides.resourceName} to support overrides?`).send('y');
+    }
+    chain
       .wait('What do you want to do?')
       .send(KEY_DOWN_ARROW)
       .send(KEY_DOWN_ARROW)
@@ -477,7 +489,11 @@ export function addAuthWithRecaptchaTrigger(cwd: string, settings: any): Promise
 
 export function updateAuthRemoveRecaptchaTrigger(cwd: string, settings: any): Promise<void> {
   return new Promise((resolve, reject) => {
-    spawn(getCLIPath(), ['update', 'auth'], { cwd, stripColors: true })
+    const chain = spawn(getCLIPath(), ['update', 'auth'], { cwd, stripColors: true });
+    if (settings?.overrides?.category === 'auth') {
+      chain.wait(`Do you want to migrate this ${settings.overrides.resourceName} to support overrides?`).send('y');
+    }
+    chain
       .wait('What do you want to do')
       .send(KEY_DOWN_ARROW)
       .sendCarriageReturn()
@@ -565,9 +581,8 @@ export function addAuthWithSignInSignOutUrl(cwd: string, settings: any): Promise
 
 export function addAuthWithDefaultSocial_v4_30(cwd: string, settings: any): Promise<void> {
   return new Promise((resolve, reject) => {
-    const { FACEBOOK_APP_ID, FACEBOOK_APP_SECRET, GOOGLE_APP_ID, GOOGLE_APP_SECRET, AMAZON_APP_ID, AMAZON_APP_SECRET } = getSocialProviders(
-      true,
-    );
+    const { FACEBOOK_APP_ID, FACEBOOK_APP_SECRET, GOOGLE_APP_ID, GOOGLE_APP_SECRET, AMAZON_APP_ID, AMAZON_APP_SECRET } =
+      getSocialProviders(true);
 
     spawn(getCLIPath(), ['add', 'auth'], { cwd, stripColors: true })
       .wait('Do you want to use the default authentication and security configuration?')
@@ -1159,13 +1174,17 @@ export function addAuthWithPreTokenGenerationTrigger(projectDir: string): Promis
   });
 }
 
-export function updateAuthAddUserGroups(projectDir: string, groupNames: string[]): Promise<void> {
+export function updateAuthAddUserGroups(projectDir: string, groupNames: string[], settings?: any): Promise<void> {
   if (groupNames.length == 0) {
     return;
   }
 
   return new Promise((resolve, reject) => {
-    let chain = spawn(getCLIPath(), ['update', 'auth'], { cwd: projectDir, stripColors: true })
+    const chain = spawn(getCLIPath(), ['update', 'auth'], { cwd: projectDir, stripColors: true });
+    if (settings?.overrides?.category === 'auth') {
+      chain.wait(`Do you want to migrate this ${settings.overrides.resourceName} to support overrides?`).sendLine('y');
+    }
+    chain
       .wait('What do you want to do?')
       .send(KEY_DOWN_ARROW)
       .send(KEY_DOWN_ARROW)
@@ -1479,9 +1498,13 @@ export function addAuthUserPoolOnlyNoOAuth(cwd: string, settings: AddAuthUserPoo
   });
 }
 
-export function updateAuthAddAdminQueries(projectDir: string, groupName: string = 'adminQueriesGroup'): Promise<void> {
+export function updateAuthAddAdminQueries(projectDir: string, groupName: string = 'adminQueriesGroup', settings?: any): Promise<void> {
   return new Promise((resolve, reject) => {
-    spawn(getCLIPath(), ['update', 'auth'], { cwd: projectDir, stripColors: true })
+    const chain = spawn(getCLIPath(), ['update', 'auth'], { cwd: projectDir, stripColors: true });
+    if (settings?.overrides?.category === 'auth') {
+      chain.wait(`Do you want to migrate this ${settings.overrides.resourceName} to support overrides?`).sendLine('y');
+    }
+    chain
       .wait('What do you want to do?')
       .send(KEY_DOWN_ARROW)
       .send(KEY_DOWN_ARROW)
@@ -1508,7 +1531,11 @@ export function updateAuthAddAdminQueries(projectDir: string, groupName: string
 
 export function updateAuthWithoutTrigger(cwd: string, settings: any): Promise<void> {
   return new Promise((resolve, reject) => {
-    spawn(getCLIPath(), ['update', 'auth'], { cwd, stripColors: true })
+    const chain = spawn(getCLIPath(), ['update', 'auth'], { cwd, stripColors: true });
+    if (settings?.overrides?.category === 'auth') {
+      chain.wait(`Do you want to migrate this ${settings.overrides.resourceName} to support overrides?`).sendConfirmYes();
+    }
+    chain
       .wait('What do you want to do?')
       .send(KEY_DOWN_ARROW)
       .sendCarriageReturn()
diff --git a/packages/amplify-e2e-core/src/init/index.ts b/packages/amplify-e2e-core/src/init/index.ts
index b27bca0fddc..27746525fed 100644
--- a/packages/amplify-e2e-core/src/init/index.ts
+++ b/packages/amplify-e2e-core/src/init/index.ts
@@ -4,4 +4,4 @@ export * from './deleteProject';
 export * from './initProjectHelper';
 export * from './pull-headless';
 export * from './adminUI';
-export * from './overrideRootStack';
+export * from './overrideStack';
diff --git a/packages/amplify-e2e-core/src/init/overrideRootStack.ts b/packages/amplify-e2e-core/src/init/overrideStack.ts
similarity index 52%
rename from packages/amplify-e2e-core/src/init/overrideRootStack.ts
rename to packages/amplify-e2e-core/src/init/overrideStack.ts
index 997c33b9e72..fedc9b04ab5 100644
--- a/packages/amplify-e2e-core/src/init/overrideRootStack.ts
+++ b/packages/amplify-e2e-core/src/init/overrideStack.ts
@@ -17,3 +17,21 @@ export function amplifyOverrideRoot(cwd: string, settings: {}) {
       });
   });
 }
+
+export function amplifyOverrideAuth(cwd: string, settings: {}) {
+  return new Promise((resolve, reject) => {
+    const args = ['override', 'auth'];
+
+    spawn(getCLIPath(), args, { cwd, stripColors: true })
+      .wait('Do you want to edit override.ts file now?')
+      .sendConfirmNo()
+      .sendEof()
+      .run((err: Error) => {
+        if (!err) {
+          resolve({});
+        } else {
+          reject(err);
+        }
+      });
+  });
+}
diff --git a/packages/amplify-e2e-core/src/utils/projectMeta.ts b/packages/amplify-e2e-core/src/utils/projectMeta.ts
index 89786752821..21f8d1cc9ae 100644
--- a/packages/amplify-e2e-core/src/utils/projectMeta.ts
+++ b/packages/amplify-e2e-core/src/utils/projectMeta.ts
@@ -60,7 +60,7 @@ function getCloudBackendConfig(projectRoot: string) {
 }
 
 function getParameterPath(projRoot: string, category: string, resourceName: string) {
-  return path.join(projRoot, 'amplify', 'backend', category, resourceName, 'parameters.json');
+  return path.join(projRoot, 'amplify', 'backend', category, resourceName, 'build', 'parameters.json');
 }
 
 function getCategoryParameterPath(projRoot: string, category: string, resourceName: string) {
diff --git a/packages/amplify-e2e-tests/overrides/override-auth.ts b/packages/amplify-e2e-tests/overrides/override-auth.ts
new file mode 100644
index 00000000000..0f4026c212a
--- /dev/null
+++ b/packages/amplify-e2e-tests/overrides/override-auth.ts
@@ -0,0 +1,6 @@
+export function overrideProps(props: any): any {
+  props.userPool.deviceConfiguration = {
+    challengeRequiredOnNewDevice: true,
+  };
+  return props;
+}
diff --git a/packages/amplify-e2e-tests/src/__tests__/auth_1.test.ts b/packages/amplify-e2e-tests/src/__tests__/auth_1.test.ts
index dd6cb83f89b..1183dedcc2b 100644
--- a/packages/amplify-e2e-tests/src/__tests__/auth_1.test.ts
+++ b/packages/amplify-e2e-tests/src/__tests__/auth_1.test.ts
@@ -27,8 +27,8 @@ describe('amplify add auth...', () => {
   });
 
   afterEach(async () => {
-    await deleteProject(projRoot);
-    deleteProjectDir(projRoot);
+    // await deleteProject(projRoot);
+    // deleteProjectDir(projRoot);
   });
 
   it('...should init a project and add auth with defaults', async () => {
@@ -71,7 +71,7 @@ describe('amplify add auth...', () => {
     expect(clients[0].UserPoolClient.ClientSecret).toBeDefined();
   });
 
-  it('...should init an Android project and add default auth', async () => {
+  it.only('...should init an Android project and add default auth', async () => {
     await initAndroidProjectWithProfile(projRoot, defaultsSettings);
     await addAuthWithDefault(projRoot, {});
     await amplifyPushAuth(projRoot);
diff --git a/packages/amplify-e2e-tests/src/__tests__/auth_6.test.ts b/packages/amplify-e2e-tests/src/__tests__/auth_6.test.ts
index 55f964e631d..98787b0d952 100644
--- a/packages/amplify-e2e-tests/src/__tests__/auth_6.test.ts
+++ b/packages/amplify-e2e-tests/src/__tests__/auth_6.test.ts
@@ -1,13 +1,20 @@
 import { $TSAny } from 'amplify-cli-core';
 import {
+  addAuthWithDefault,
   addAuthWithMaxOptions,
+  amplifyOverrideAuth,
   amplifyPushAuth,
+  amplifyPushOverride,
   createNewProjectDir,
   deleteProject,
   deleteProjectDir,
   getProjectMeta,
+  getUserPool,
   initJSProjectWithProfile,
+  runAmplifyAuthConsole,
 } from 'amplify-e2e-core';
+import * as path from 'path';
+import * as fs from 'fs-extra';
 
 const PROJECT_NAME = 'authTest';
 const defaultSettings = {
@@ -63,4 +70,27 @@ describe('zero config auth ', () => {
       }
     `);
   });
+
+  it('...should init a project and add auth with defaults with overrides', async () => {
+    await initJSProjectWithProfile(projRoot, defaultSettings);
+    await addAuthWithDefault(projRoot, {});
+    await amplifyPushAuth(projRoot);
+    await runAmplifyAuthConsole(projRoot);
+    const meta = getProjectMeta(projRoot);
+    const authResourceName = Object.keys(meta.auth).filter(key => meta.auth[key].service === 'Cognito');
+    const id = Object.keys(meta.auth).map(key => meta.auth[key])[0].output.UserPoolId;
+    const userPool = await getUserPool(id, meta.providers.awscloudformation.Region);
+    expect(userPool.UserPool).toBeDefined();
+
+    // override new env
+    await amplifyOverrideAuth(projRoot, {});
+    const srcOverrideFilePath = path.join(__dirname, '..', '..', 'overrides', 'override-auth.ts');
+    const destOverrideFilePath = path.join(projRoot, 'amplify', 'backend', 'auth', `${authResourceName}`, 'override.ts');
+    fs.copyFileSync(srcOverrideFilePath, destOverrideFilePath);
+    await amplifyPushOverride(projRoot);
+    // check overidden config
+    const overridenUserPool = await getUserPool(id, meta.providers.awscloudformation.Region);
+    expect(overridenUserPool.UserPool).toBeDefined();
+    expect(overridenUserPool.UserPool.DeviceConfiguration.ChallengeRequiredOnNewDevice).toBe(true);
+  });
 });
diff --git a/packages/amplify-e2e-tests/src/import-helpers/utilities.ts b/packages/amplify-e2e-tests/src/import-helpers/utilities.ts
index 66b0faf747b..94a84dcbb78 100644
--- a/packages/amplify-e2e-tests/src/import-helpers/utilities.ts
+++ b/packages/amplify-e2e-tests/src/import-helpers/utilities.ts
@@ -10,7 +10,7 @@ import {
   amplifyPushAuth,
   getBackendAmplifyMeta,
   getProjectMeta,
-  getTeamProviderInfo
+  getTeamProviderInfo,
 } from 'amplify-e2e-core';
 
 import _ from 'lodash';
@@ -126,14 +126,14 @@ export const getOGAuthProjectDetails = (projectRoot: string): AuthProjectDetails
 };
 
 export const readResourceParametersJson = (projectRoot: string, category: string, resourceName: string): $TSObject => {
-  const parametersFilePath = path.join(projectRoot, 'amplify', 'backend', category, resourceName, 'parameters.json');
+  const parametersFilePath = path.join(projectRoot, 'amplify', 'backend', category, resourceName, 'build', 'parameters.json');
   const parameters = JSONUtilities.readJson(parametersFilePath);
 
   return parameters;
 };
 
 export const readRootStack = (projectRoot: string): $TSObject => {
-  const rootStackFilePath = path.join(projectRoot, 'amplify', 'backend', 'awscloudformation', 'nested-cloudformation-stack.yml');
+  const rootStackFilePath = path.join(projectRoot, 'amplify', 'backend', 'awscloudformation', 'build', 'root-cloudformation-stack.json');
   const rootStack = JSONUtilities.readJson(rootStackFilePath);
 
   return rootStack;
diff --git a/packages/amplify-migration-tests/package.json b/packages/amplify-migration-tests/package.json
index 470aff2b741..b06c5dd2c96 100644
--- a/packages/amplify-migration-tests/package.json
+++ b/packages/amplify-migration-tests/package.json
@@ -22,7 +22,7 @@
     "migration_v4.30.0_auth": "npm run setup-profile 4.30.0 && jest src/__tests__/migration_tests/auth-deployment-migration/auth.deployment.secrets.test.ts --verbose",
     "migration_v4.28.2_nonmultienv_layers": "npm run setup-profile 4.28.2 && jest src/__tests__/migration_tests/lambda-layer-migration/layer-migration.test.ts --verbose",
     "migration_v4.52.0_multienv_layers": "npm run setup-profile 4.52.0 && jest src/__tests__/migration_tests/lambda-layer-migration/layer-migration.test.ts --verbose",
-    "migration_v6.0.1": "npm run setup-profile 6.0.1 && jest src/__tests__/migration_tests_overrides/ --verbose",
+    "migration_v6.0.1": "npm run setup-profile 6.0.1 && jest src/__tests__/migration_tests/overrides/auth-migration.test.ts --verbose",
 
     "migration": "npm run setup-profile latest && jest --testPathIgnorePatterns=auth.deployment.secrets\\|layer-migration --verbose",
     "setup-profile": "ts-node ./src/configure_tests.ts"
diff --git a/packages/amplify-migration-tests/src/__tests__/migration_tests/overrides/auth-migration.test.ts b/packages/amplify-migration-tests/src/__tests__/migration_tests/overrides/auth-migration.test.ts
new file mode 100644
index 00000000000..9b52d13d872
--- /dev/null
+++ b/packages/amplify-migration-tests/src/__tests__/migration_tests/overrides/auth-migration.test.ts
@@ -0,0 +1,139 @@
+import { $TSAny, JSONUtilities } from 'amplify-cli-core';
+import {
+  addAuthWithCustomTrigger,
+  addAuthWithDefault,
+  addAuthWithRecaptchaTrigger,
+  addAuthWithSignInSignOutUrl,
+  amplifyPushAuth,
+  createNewProjectDir,
+  deleteProject,
+  deleteProjectDir,
+  getAwsAndroidConfig,
+  getLambdaFunction,
+  getProjectMeta,
+  getUserPool,
+  getUserPoolClients,
+  initAndroidProjectWithProfile,
+  initJSProjectWithProfile,
+  updateAuthRemoveRecaptchaTrigger,
+  updateAuthSignInSignOutUrl,
+  updateAuthWithoutCustomTrigger,
+  updateAuthWithoutTrigger,
+} from 'amplify-e2e-core';
+import * as fs from 'fs-extra';
+import * as path from 'path';
+
+const defaultSettings = {
+  name: 'authMigration',
+};
+describe('amplify auth migration', () => {
+  let projRoot: string;
+  beforeEach(async () => {
+    projRoot = await createNewProjectDir('auth_migration');
+  });
+
+  afterEach(async () => {
+    const metaFilePath = path.join(projRoot, 'amplify', '#current-cloud-backend', 'amplify-meta.json');
+    if (fs.existsSync(metaFilePath)) {
+      await deleteProject(projRoot);
+    }
+    deleteProjectDir(projRoot);
+  });
+  it('...should init a project and add auth with a custom trigger, and then update to remove the custom js while leaving the other js', async () => {
+    // init, add and push auth with installed cli
+    await initJSProjectWithProfile(projRoot, defaultSettings);
+    await addAuthWithCustomTrigger(projRoot, {});
+    await amplifyPushAuth(projRoot);
+    const meta = getProjectMeta(projRoot);
+
+    const functionName = `${Object.keys(meta.auth)[0]}PreSignup-integtest`;
+
+    const authMeta = Object.keys(meta.auth).map(key => meta.auth[key])[0];
+    const id = authMeta.output.UserPoolId;
+    const userPool = await getUserPool(id, meta.providers.awscloudformation.Region);
+    const clientIds = [authMeta.output.AppClientIDWeb, authMeta.output.AppClientID];
+    const clients = await getUserPoolClients(id, clientIds, meta.providers.awscloudformation.Region);
+
+    const lambdaFunction = await getLambdaFunction(functionName, meta.providers.awscloudformation.Region);
+    const dirContents = fs.readdirSync(`${projRoot}/amplify/backend/function/${Object.keys(meta.auth)[0]}PreSignup/src`);
+    expect(dirContents.includes('custom.js')).toBeTruthy();
+    expect(userPool.UserPool).toBeDefined();
+    expect(clients).toHaveLength(2);
+    expect(lambdaFunction).toBeDefined();
+    expect(lambdaFunction.Configuration.Environment.Variables.MODULES).toEqual('email-filter-denylist,custom');
+
+    // update and push with codebase
+    const overridesObj: $TSAny = {
+      resourceName: Object.keys(authMeta)[0],
+      category: 'auth',
+      service: 'cognito',
+    };
+    await updateAuthWithoutCustomTrigger(projRoot, { testingWithLatestCodebase: true, overrides: overridesObj });
+    await amplifyPushAuth(projRoot, true);
+    const updatedFunction = await getLambdaFunction(functionName, meta.providers.awscloudformation.Region);
+    const updatedDirContents = fs.readdirSync(`${projRoot}/amplify/backend/function/${Object.keys(meta.auth)[0]}PreSignup/src`);
+    expect(updatedDirContents.includes('custom.js')).toBeFalsy();
+    expect(updatedDirContents.includes('email-filter-denylist.js')).toBeTruthy();
+    expect(updatedFunction.Configuration.Environment.Variables.MODULES).toEqual('email-filter-denylist');
+  });
+
+  it('...should init a project and add auth with default, and then update with latest and push', async () => {
+    // init, add and push auth with installed cli
+    await initJSProjectWithProfile(projRoot, defaultSettings);
+    await addAuthWithDefault(projRoot, {});
+    await amplifyPushAuth(projRoot);
+    const meta = getProjectMeta(projRoot);
+    const authMeta = Object.keys(meta.auth).map(key => meta.auth[key])[0];
+    // update and push with codebase
+    const overridesObj: $TSAny = {
+      resourceName: Object.keys(authMeta)[0],
+      category: 'auth',
+      service: 'cognito',
+    };
+    await updateAuthWithoutTrigger(projRoot, { testingWithLatestCodebase: true, overrides: overridesObj });
+    await amplifyPushAuth(projRoot, true);
+  });
+
+  it('...should init an android project and add customAuth flag, and remove flag when custom auth triggers are removed upon update ', async () => {
+    await initAndroidProjectWithProfile(projRoot, defaultSettings);
+    await addAuthWithRecaptchaTrigger(projRoot, {});
+    await amplifyPushAuth(projRoot);
+    let meta = getAwsAndroidConfig(projRoot);
+    expect(meta.Auth.Default.authenticationFlowType).toBeDefined();
+    expect(meta.Auth.Default.authenticationFlowType).toEqual('CUSTOM_AUTH');
+
+    await updateAuthRemoveRecaptchaTrigger(projRoot, {});
+    await amplifyPushAuth(projRoot);
+    meta = getAwsAndroidConfig(projRoot);
+    expect(meta.Auth.Default.authenticationFlowType).toBeDefined();
+    expect(meta.Auth.Default.authenticationFlowType).toEqual('USER_SRP_AUTH');
+  });
+
+  it('...should edit signin url on update', async () => {
+    const settings = {
+      signinUrl: 'http://localhost:3001/',
+      signoutUrl: 'http://localhost:3002/',
+      updatesigninUrl: 'http://localhost:3003/',
+      updatesignoutUrl: 'http://localhost:3004/',
+    };
+    await initAndroidProjectWithProfile(projRoot, defaultSettings);
+    await addAuthWithSignInSignOutUrl(projRoot, settings);
+    // turn ON feature flag
+    await updateAuthSignInSignOutUrl(projRoot, settings);
+  });
+
+  it('...should init an android project and add customAuth flag, and remove flag when custom auth triggers are removed upon update ', async () => {
+    await initAndroidProjectWithProfile(projRoot, defaultSettings);
+    await addAuthWithRecaptchaTrigger(projRoot, {});
+    await amplifyPushAuth(projRoot);
+    let meta = getAwsAndroidConfig(projRoot);
+    expect(meta.Auth.Default.authenticationFlowType).toBeDefined();
+    expect(meta.Auth.Default.authenticationFlowType).toEqual('CUSTOM_AUTH');
+
+    await updateAuthRemoveRecaptchaTrigger(projRoot, {});
+    await amplifyPushAuth(projRoot);
+    meta = getAwsAndroidConfig(projRoot);
+    expect(meta.Auth.Default.authenticationFlowType).toBeDefined();
+    expect(meta.Auth.Default.authenticationFlowType).toEqual('USER_SRP_AUTH');
+  });
+});
diff --git a/packages/amplify-provider-awscloudformation/package.json b/packages/amplify-provider-awscloudformation/package.json
index 7cc530a9c1e..7881f10cab3 100644
--- a/packages/amplify-provider-awscloudformation/package.json
+++ b/packages/amplify-provider-awscloudformation/package.json
@@ -119,6 +119,7 @@
     "promise-sequential": "^1.1.1",
     "proxy-agent": "^5.0.0",
     "rimraf": "^3.0.0",
+    "vm2": "^3.9.3",
     "xstate": "^4.14.0"
   },
   "devDependencies": {
diff --git a/packages/amplify-provider-awscloudformation/src/root-stack-builder/root-stack-transform.ts b/packages/amplify-provider-awscloudformation/src/root-stack-builder/root-stack-transform.ts
index ab0e4791afa..5d2c2edc2cd 100644
--- a/packages/amplify-provider-awscloudformation/src/root-stack-builder/root-stack-transform.ts
+++ b/packages/amplify-provider-awscloudformation/src/root-stack-builder/root-stack-transform.ts
@@ -1,11 +1,15 @@
 import { AmplifyRootStackTemplate } from './types';
-import { $TSContext, CFNTemplateFormat, Template, pathManager, writeCFNTemplate, buildOverrideDir } from 'amplify-cli-core';
+import { $TSContext, CFNTemplateFormat, Template, pathManager, writeCFNTemplate, buildOverrideDir, $TSAny } from 'amplify-cli-core';
 import { AmplifyRootStack, AmplifyRootStackOutputs } from './root-stack-builder';
 import { RootStackSythesizer } from './stack-synthesizer';
 import { App } from '@aws-cdk/core';
 import * as cdk from '@aws-cdk/core';
 import * as path from 'path';
 import * as amplifyPrinter from 'amplify-prompts';
+import * as fs from 'fs-extra';
+import os from 'os';
+import * as vm from 'vm2';
+import { printer } from 'amplify-prompts';
 
 export class AmplifyRootStackTransform {
   private app: App | undefined;
@@ -50,28 +54,23 @@ export class AmplifyRootStackTransform {
     });
     // skip if packageManager or override.ts not found
     if (isBuild) {
-      const { overrideProps } = await import(path.join(overrideFilePath, 'build', 'override.js')).catch(error => {
-        amplifyPrinter.formatter.list([
-          'No override File Found',
-          `To override ${this._resourceName} run amplify override auth ${this._resourceName} `,
-        ]);
-        return undefined;
+      const overrideCode: string = await fs.readFile(path.join(overrideFilePath, 'build', 'override.js'), 'utf-8').catch(() => {
+        amplifyPrinter.formatter.list(['No override File Found', `To override ${this._resourceName} run amplify override auth`]);
+        return '';
       });
-
-      // pass stack object
       const rootStackTemplateObj = this._rootTemplateObj as AmplifyRootStackTemplate;
-      //TODO: Check Script Options
-      if (typeof overrideProps === 'function' && overrideProps) {
-        try {
-          this._rootTemplateObj = overrideProps(rootStackTemplateObj);
-
-          //The vm module enables compiling and running code within V8 Virtual Machine contexts. The vm module is not a security mechanism. Do not use it to run untrusted code.
-          // const script = new vm.Script(overrideCode);
-          // script.runInContext(vm.createContext(cognitoStackTemplateObj));
-          return;
-        } catch (error) {
-          throw new Error(error);
-        }
+      const sandboxNode = new vm.NodeVM({
+        console: 'inherit',
+        timeout: 5000,
+        sandbox: {},
+      });
+      try {
+        this._rootTemplateObj = sandboxNode.run(overrideCode).overrideProps(rootStackTemplateObj);
+      } catch (err: $TSAny) {
+        const error = new Error(`Skipping override due to ${err}${os.EOL}`);
+        printer.error(`${error}`);
+        error.stack = undefined;
+        throw error;
       }
     }
   };
diff --git a/packages/amplify-provider-awscloudformation/src/root-stack-builder/stack-synthesizer.ts b/packages/amplify-provider-awscloudformation/src/root-stack-builder/stack-synthesizer.ts
index 7a951e90c2e..bbf7de6d33f 100644
--- a/packages/amplify-provider-awscloudformation/src/root-stack-builder/stack-synthesizer.ts
+++ b/packages/amplify-provider-awscloudformation/src/root-stack-builder/stack-synthesizer.ts
@@ -7,18 +7,11 @@ export class RootStackSythesizer extends LegacyStackSynthesizer {
   private static readonly stackAssets: Map<string, Template> = new Map();
 
   protected synthesizeStackTemplate(stack: Stack, session: ISynthesisSession): void {
-    if (stack instanceof AmplifyRootStackOutputs) {
+    if (stack instanceof AmplifyRootStack || stack instanceof AmplifyRootStackOutputs) {
       this.addStack(stack);
       const template = stack.renderCloudFormationTemplate(session) as string;
       const templateName = stack.node.id;
       this.setStackAsset(templateName, template);
-      return;
-    } else if (stack instanceof AmplifyRootStack) {
-      this.addStack(stack);
-      const template = stack.renderCloudFormationTemplate(session) as string;
-      const templateName = stack.node.id;
-      this.setStackAsset(templateName, template);
-      return;
     } else {
       throw new Error('Error synthesizing the template. Expected Stack to be either instance of AmplifyRootStack');
     }