Multi-bucket defineStorage must allow access to the same paths for all buckets, otherwise typescript error occurs on Amplify.configure

[johnpc]

Environment information

➜  story-teller git:(main) npx ampx info

System:
  OS: macOS 15.2
  CPU: (10) arm64 Apple M1 Pro
  Memory: 464.42 MB / 32.00 GB
  Shell: /bin/zsh
Binaries:
  Node: 23.4.0 - /opt/homebrew/bin/node
  Yarn: 1.22.21 - /opt/homebrew/bin/yarn
  npm: 10.9.2 - /opt/homebrew/bin/npm
  pnpm: 9.8.0 - /opt/homebrew/bin/pnpm
NPM Packages:
  @aws-amplify/auth-construct: 1.5.1
  @aws-amplify/backend: 1.11.0
  @aws-amplify/backend-auth: 1.4.2
  @aws-amplify/backend-cli: 1.4.5
  @aws-amplify/backend-data: 1.3.0
  @aws-amplify/backend-deployer: 1.1.12
  @aws-amplify/backend-function: 1.10.0
  @aws-amplify/backend-output-schemas: 1.4.0
  @aws-amplify/backend-output-storage: 1.1.4
  @aws-amplify/backend-secret: 1.1.5
  @aws-amplify/backend-storage: 1.2.4
  @aws-amplify/cli-core: 1.2.1
  @aws-amplify/client-config: 1.5.4
  @aws-amplify/deployed-backend-client: 1.5.0
  @aws-amplify/form-generator: 1.0.3
  @aws-amplify/model-generator: 1.0.11
  @aws-amplify/platform-core: 1.4.0
  @aws-amplify/plugin-types: 1.6.0
  @aws-amplify/sandbox: 1.2.8
  @aws-amplify/schema-generator: 1.2.6
  aws-amplify: 6.11.0
  aws-cdk: 2.172.0
  aws-cdk-lib: 2.172.0
  typescript: 5.7.2

Describe the bug

Amplify.configure() fails with a typescript error caused by the storage types when both defineStorage calls use different access patterns.

Reproduction steps

1. git clone -b bug-repro https://github.com/johnpc/story-teller/
2. cd story-teller
3. npm install && npx ampx sandbox --once
4. npm run build

Notice build failure:

➜  story-teller git:(main) ✗ npm run build

> [email protected] build
> tsc -b && vite build

src/main.tsx:9:19 - error TS2345: Argument of type '{ auth: { user_pool_id: string; aws_region: string; user_pool_client_id: string; identity_pool_id: string; mfa_methods: never[]; standard_required_attributes: string[]; username_attributes: string[]; ... 4 more ...; unauthenticated_identities_enabled: boolean; }; data: { ...; }; storage: { ...; }; version: string; }' is not assignable to parameter of type 'ResourcesConfig | LegacyConfig | AmplifyOutputs'.
  Type '{ auth: { user_pool_id: string; aws_region: string; user_pool_client_id: string; identity_pool_id: string; mfa_methods: never[]; standard_required_attributes: string[]; username_attributes: string[]; ... 4 more ...; unauthenticated_identities_enabled: boolean; }; data: { ...; }; storage: { ...; }; version: string; }' is not assignable to type 'AmplifyOutputs'.
    The types of 'storage.buckets' are incompatible between these types.
      Type '({ name: string; bucket_name: string; aws_region: string; paths: { "pictures/*": { authenticated: string[]; }; "textfiles/*"?: undefined; }; } | { name: string; bucket_name: string; aws_region: string; paths: { ...; }; })[]' is not assignable to type 'AmplifyOutputsStorageBucketProperties[]'.
        Type '{ name: string; bucket_name: string; aws_region: string; paths: { "pictures/*": { authenticated: string[]; }; "textfiles/*"?: undefined; }; } | { name: string; bucket_name: string; aws_region: string; paths: { ...; }; }' is not assignable to type 'AmplifyOutputsStorageBucketProperties'.
          Type '{ name: string; bucket_name: string; aws_region: string; paths: { "pictures/*": { authenticated: string[]; }; "textfiles/*"?: undefined; }; }' is not assignable to type 'AmplifyOutputsStorageBucketProperties'.
            Types of property 'paths' are incompatible.
              Type '{ "pictures/*": { authenticated: string[]; }; "textfiles/*"?: undefined; }' is not assignable to type 'Record<string, Record<string, string[] | undefined>>'.
                Property '"textfiles/*"' is incompatible with index signature.
                  Type 'undefined' is not assignable to type 'Record<string, string[] | undefined>'.

9 Amplify.configure(config);
                    ~~~~~~

Note: You can solve the build failure by replacing amplify/storage/resource.ts with the following contents (see diff):

import { defineStorage } from "@aws-amplify/backend";

export const storage = defineStorage({
  name: "pictureDrive",
  isDefault: true,
  access: (allow) => ({
    "pictures/*": [allow.authenticated.to(["read", "write", "delete"])],
    "textfiles/*": [allow.authenticated.to(["read", "write", "delete"])],
  }),
});

export const knowledgeBaseBucket = defineStorage({
  name: "knowledgeBaseBucket",
  access: (allow) => ({
    "pictures/*": [allow.authenticated.to(["read", "write", "delete"])],
    "textfiles/*": [allow.authenticated.to(["read", "write", "delete"])],
  }),
});

The knowledgeBaseBucket only needs the textfiles/* path, and the pictureDrive bucket only needs access to the pictures/* path. However, you have to grant both paths to both buckets to prevent the typescript error on Amplify.config()

[ykethan]

Hey,👋 thanks for raising this! I'm going to transfer this over to our JS repository for better assistance 🙂

[cwomack]

@johnpc, thanks for opening this issue! We're confirming this is a bug and there's actually a PR already merged and ready for release to address this! You can verify if it resolves the issue by using aws-amplify@unstable (though it may requires you deleting your node_modules folder and package-lock.json file, then reinstalling dependencies).

We'll comment again on this issue once the fix is released, but feel free to test it on unstable in the mean time.

[johnpc]

I've confirmed it works. However, for reasons I cannot understand, it was not enough to simply remove node_modules and package-lock.json then update dependency to "aws-amplify": "unstable". I also had to add overrides:

  "overrides": {
    "aws-amplify": "unstable"
  }

without the overrides, my npx ampx info still showed aws-amplify as 6.11.0

[AllanZhengYP]

Hi @johnpc

This fix has been merged into the latest version [email protected]. Please let me know if it doesn't work for you!

[johnpc]

Confirmed fixed!