AWS : Invalid identity pool configuration. Check assigned IAM roles for this pool

user_7425764 0
Viewed 21460

I have created one user pool & identity pool.

I have used javascript sdk.

I am able to signup, send confirmation code & confirm user successfully with javascript sdk.

But when i try to sign in user with authenticate method & try to get credentials with "CognitoIdentityCredentials" by passing idToken with below code

logins[cognitoEndpoint + "/" + userPoolId] = jwtToken;

    AWS.config.credentials = new AWS.CognitoIdentityCredentials({
      IdentityPoolId: identityPoolId,
      Logins: logins
    });

it's giving me below error

Error: Invalid identity pool configuration. Check assigned IAM roles for this pool.
    at Request.extractError (aws-sdk.js:104063)
    at Request.callListeners (aws-sdk.js:106060)
    at Request.emit (aws-sdk.js:106034)
    at Request.emit (aws-sdk.js:105121)
    at Request.transition (aws-sdk.js:104843)
    at AcceptorStateMachine.runTo (aws-sdk.js:108480)
    at aws-sdk.js:108492
    at Request.<anonymous> (aws-sdk.js:104859)
    at Request.<anonymous> (aws-sdk.js:105123)
    at Request.callListeners (aws-sdk.js:106070)

I have given administrator access to "Unauthenticated role" & "Unauthenticated role" of identity pool and to user whose credentials i am using.

I am new to aws. Can anyone tell me what am i missing?

Any help would be appreciated.

amazon-cognito angularjs aws-sdk amazon-web-services javascript
7 Answers

When you create role in IAM and choose identity provider, make sure you don't choose user pool id, instead, you have to choose identity pool id.

user_93620360

I had this issue when I manually added additional roles in Cognito to the already existing. (previously created with amplify CLI)

TLDR: Don't manually create groups and roles if you're going to be using them for Amplify.

My accounts which had this error included the following attributes in that JWT. (you can go to jwt.io and see your attributes)

"cognito:roles": [
    "arn:aws:iam::*ACCOUNT_ID*:role/*THE_ROLE*"
  ],
"cognito:preferred_role": "arn:aws:iam::*ACCOUNT_ID*:role/*THE_ROLE*",

Then I found these roles and I tried to verify if they have correct conditions attached to them:

"Condition": { "StringEquals": { "cognito-identity.amazonaws.com:aud": "us-west-2:<COGNITO_IDENTITY_POOL_ID>" }, "ForAnyValue:StringLike": { "cognito-identity.amazonaws.com:amr": "authenticated" } }

After a few hours of verifing the roles, configuring them it started finally working.

Lessons learned: It's possible to fix them manually too.

Then I manually deleted the groups in Cognito I've created along with the roles associated with them and then recreated it via the Amplify CLI from scratch. It worked like a charm. Apart from that in this way Amplify will maintains them, when I change configs etc.

user_87472260

I had this error working with amplify. I noticed that the error appeared after I created Cognito User Roles from amplify cli. What I did was, delete these roles from CLI and create again from AWS Console and it worked fine!

user_133405880

I have had similar error, resolved it by adding the below in the trust policy

Note: You should include sts:TagSession in the IAM role’s trust policy before enabling this feature.

user_21782090

If you are using OpenID, disable attributes for access control and error will be gone

Image

user_105219450
Related