diff --git a/pkg/controller/cognitoidentityprovider/groupusermembership/controller.go b/pkg/controller/cognitoidentityprovider/groupusermembership/controller.go
index ec4b3e31d2..c73e7bacb1 100644
--- a/pkg/controller/cognitoidentityprovider/groupusermembership/controller.go
+++ b/pkg/controller/cognitoidentityprovider/groupusermembership/controller.go
@@ -151,7 +151,7 @@ func (e *external) Observe(ctx context.Context, mgd resource.Managed) (managed.E
 		return managed.ExternalObservation{}, errors.Wrap(err, errUnmarshal)
 	}
 
-	attachedGroupObject, err := FindAttachedGroupObject(ctx, e, externalAnnotation.Username, externalAnnotation.UserPoolID, externalAnnotation.Groupname)
+	attachedGroupObject, err := FindAttachedGroupObject(ctx, e, externalAnnotation.UserPoolID, externalAnnotation.Username, externalAnnotation.Groupname)
 	if err != nil {
 		return managed.ExternalObservation{}, errors.Wrap(err, errGet)
 	}
diff --git a/pkg/controller/cognitoidentityprovider/groupusermembership/controller_test.go b/pkg/controller/cognitoidentityprovider/groupusermembership/controller_test.go
index 06fd53178a..46e6b6dea7 100644
--- a/pkg/controller/cognitoidentityprovider/groupusermembership/controller_test.go
+++ b/pkg/controller/cognitoidentityprovider/groupusermembership/controller_test.go
@@ -19,6 +19,7 @@ package groupusermembership
 import (
 	"context"
 	"encoding/json"
+	"strings"
 	"testing"
 
 	"github.com/crossplane-contrib/provider-aws/apis/cognitoidentityprovider/manualv1alpha1"
@@ -111,14 +112,17 @@ func TestObserve(t *testing.T) {
 			args: args{
 				cognitoidentityprovider: &fake.MockGroupUserMembershipClient{
 					MockAdminListGroupsForUser: func(ctx context.Context, input *awscognitoidentityprovider.AdminListGroupsForUserInput, opts []func(*awscognitoidentityprovider.Options)) (*awscognitoidentityprovider.AdminListGroupsForUserOutput, error) {
-						return &awscognitoidentityprovider.AdminListGroupsForUserOutput{
-							Groups: []awscognitoidentityprovidertypes.GroupType{
-								{
-									GroupName:  &groupName,
-									UserPoolId: &userPoolID,
+						if strings.Compare(*input.UserPoolId, userPoolID) == 0 && strings.Compare(*input.Username, Username) == 0 {
+							return &awscognitoidentityprovider.AdminListGroupsForUserOutput{
+								Groups: []awscognitoidentityprovidertypes.GroupType{
+									{
+										GroupName:  &groupName,
+										UserPoolId: &userPoolID,
+									},
 								},
-							},
-						}, nil
+							}, nil
+						}
+						return nil, &awscognitoidentityprovidertypes.ResourceNotFoundException{}
 					},
 				},
 				cr: userGroup(withExternalName(groupName, Username, userPoolID)),