What scopes do I need to use for Federated Signin with Amazon through Cognito?

I am trying to set up Cognito and a hosted UI to authenticate my Amplify hosted site, allowing my users to sign in with their Amazon accounts. I've gone through the setup instructions for creating a user pool in Cognito, and added a federated login for Amazon.

I registered my app with the Amazon Developer Console, but in the "Authorized scopes" section pictured below, I'm not sure what values to add.

I tried just putting "openid profile" in, but really I'm not sure what I need. The text says the scopes I need have been selected for me already, but if I leave it blank I cannot continue setup.

After finishing setup, when I launch my hosted UI and attempt to sign in with Amazon, I get this error page back. I'll keep my client ids secret, but the scope listed in the details is "scope=openid+profile ".

Really not sure where I've gone wrong here. Just trying to protect my Amplify site behind a login instead of having it public to the world.

Any insight or assistance is greatly appreciated, thank you for reading.