(2024.04 and 2024.04.01) RES delete failure in GovCloud

During the RES delete workflow the UnprotectCognitoUserPool Lambda inactivates Deletion Protection for Cognito User Pools that will later be deleted. The Lambda execution is started by the InstallerStateMachine.

Because of default AWS CLI version differences between Commercial and GovCloud regions, the update_user_pool call in the Lambda will fail in GovCloud regions.

Customers will get the following error when trying to delete RES in GovCloud regions:

Parameter validation failed: Unknown parameter in input: \"DeletionProtection\", must be one of: UserPoolId, Policies, LambdaConfig, AutoVerifiedAttributes, SmsVerificationMessage, EmailVerificationMessage, EmailVerificationSubject, VerificationMessageTemplate, SmsAuthenticationMessage, MfaConfiguration, DeviceConfiguration, EmailConfiguration, SmsConfiguration, UserPoolTags, AdminCreateUserConfig, UserPoolAddOns, AccountRecoverySetting

Steps to reproduce the bug:

• Deploy RES in a GovCloud region
• Delete the RES stack

RES version 2024.04 and 2024.04.01

The following mitigation has been tested on RES version 2024.04

• Open the UnprotectCognitoUserPool Lambda
  • Naming convention: <env-name>-InstallerTasksUnprotectCognitoUserPool-...
• Runtime Settings -> Edit -> Select Runtime Python 3.11 -> Save
• Open CloudFormation
• Delete RES stack -> leave Retain Installer Resource UNCHECKED -> Delete