When creating a new App Client in AWS Cognito I am met with errors: [LimitExceededException] Failed to create resource server "default-m2m-resource-server" and also [ScopeDoesNotExistException]

Question

We have a number of M2M App Clients set up already but today when I try to add another one using the AWS Console I receive these errors:
* [ScopeDoesNotExistException] Failed to create app client "test-app"
* [LimitExceededException] Failed to create resource server "default-m2m-resource-server"
We have less that 100 app clients currently within this user pool and from reading the documentation we are allowed up to 1,000. So I am not sure why we are getting this limit error.

https://docs.aws.amazon.com/cognito/latest/developerguide/quotas.html

re:Post Agent · Answer

The errors you're encountering are related to resource limits in Amazon Cognito, but not specifically to the number of app clients.

The "[LimitExceededException] Failed to create resource server 'default-m2m-resource-server'" error indicates that you've reached the maximum number of resource servers that can be created in your user pool. Amazon Cognito uses resource servers to define custom OAuth 2.0 scopes for machine-to-machine (M2M) authorization.

The "[ScopeDoesNotExistException] Failed to create app client 'test-app'" error suggests that the app client creation is failing because it's trying to reference custom scopes that don't exist or can't be created due to the resource server limit.

While you may be well under the limit of 1,000 app clients, there are separate quotas for resource servers and custom scopes. When creating M2M app clients, Amazon Cognito attempts to create or reference resource servers with custom scopes to support the client credentials flow.

To resolve this issue, you can:

1. Check your current resource server usage and see if you've reached the limit
2. Request a quota increase for resource servers through the AWS Service Quotas console
3. Consider consolidating existing resource servers by using the same resource server for multiple app clients with different scope configurations
4. Review your custom scope implementation to ensure you're using scope-based multi-tenancy efficiently

For the quota increase, navigate to the AWS Service Quotas console, find the relevant quota for Amazon Cognito resource servers, select "Request quota increase," enter your desired new value, and submit the request.  
**Sources**  
[Error: Limit exceeded - AWS Resource Access Manager](https://docs.aws.amazon.com/ram/latest/userguide/tshoot-limits-exceeded.html)  
[CreateResourceServer - Amazon Cognito User Pools](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateResourceServer.html)  
[Custom scope multi-tenancy best practices - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/scope-based-multi-tenancy.html)  
[Scopes, M2M, and APIs with resource servers - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-define-resource-servers.html)

When creating a new App Client in AWS Cognito I am met with errors: [LimitExceededException] Failed to create resource server "default-m2m-resource-server" and also [ScopeDoesNotExistException]

Add your answer

Relevant content