Amplify uses 'shared-access-group' keyChain store, while also making an assumption it's private

[myeyesareblind]

Describe the bug

We have a few build of our app - AhHoc, Beta, Alpha, AppStore.

At some point, we found that when internal dev installs & launches 'Beta', it will magically sign off user from AppStore or any other build.
Turns out, we have 'keychain-access-group' entitlement added to the app.
Now, by default, KeyChain writes to ('first-keychain-access-group' ?? app-id).
Which makes the keyChain store actually shared across all the apps.
We are using cognito & it writes to the same key.

https://developer.apple.com/documentation/security/ksecattraccessgroup

If you don’t explicitly set a group, keychain services defaults to the app’s first access group, which is either the first keychain access group, or the app ID when the app has no keychain groups

I don't know why Apple has made such design choice, but the Amplify 'must' set keychain-group to app-id, otherwise it makes it shared.

Here is my keychain item that I got from Cognito, as you can see there is 'Access Group' added.

Steps To Reproduce

There are no steps, as it's mostly about build configuration.
The issue can be observed if organisation has few applications (with different bundleids) that have a shared keychain-access-group.
Both application would write into the same keychainItem.

Expected behavior

Cognito KeyChain is not shared across the apps.

Amplify Framework Version

2.3.0

Amplify Categories

Auth

Dependency manager

Swift PM

Swift version

5.9

CLI version

12.1.1

Xcode version

14.3.1

Relevant log output

na

Is this a regression?

No

Regression additional context

No response

Platforms

iOS, macOS

OS Version

iOS 16

Device

iPhone X

Specific to simulators

No response

Additional context

My team spend quite some time figuring this out ...

[atierian]

Thanks for reporting this and for the thorough explanation @myeyesareblind!

We're actively investigating it and will get back back to you here as soon as possible.

[thisisabhash]

Hello,
Thank you for posting this.
Currently, you may workaround this by adding a unique keychain access group(eg. Bundle ID of your app flavor) to top of the list in the
keychain group.

We currently have a feature request in place for adding an accessGroup parameter to AWSCognitoAuthPlugin to support Keychain access groups. You may track that feature request there. #2508

[github-actions]

This has been identified as a feature request. If this feature is important to you, we strongly encourage you to give a 👍 reaction on the request. This helps us prioritize new features most important to you. Thank you!

[thisisabhash]

Tracking this in #2508 and closing this.