AWS Cognito IAM : InvalidSmsRoleTrustRelationshipException: Role does not have a trust relationship allowing Cognito to assume the role

user_1520421 0
Viewed 2706

I am trying to create a Cognito user Pool through a lambda function, using Go lang.

The IAM Role, IAM policy and the Trust relationship policy is getting created successfully.

But when I try to create the Cognito pool, I am getting an error,

InvalidSmsRoleTrustRelationshipException: Role does not have a trust relationship allowing Cognito to assume the role.

The trust relationship policy is

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "cognito-idp.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

The Create user Pool API call is as below -

newUserPoolData := &cognitoidentityprovider.CreateUserPoolInput{
        PoolName:               aws.String(poolName),
        Policies:               &userPoolPolicyType,
        AutoVerifiedAttributes: autoVerifiedAttributes,
        UsernameAttributes:     userNameAttributes,
        SmsConfiguration:       &smsConfingType,
    }

Am I missing something here?

amazon-iam aws-lambda amazon-cognito amazon-web-services
1 Answers

The service role policy should have the service-role path. For example the arn should be in the format arn:aws:iam::{ACCOUNT_ID}:role/service-role/{role_name}

The trust relationship should be:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "cognito-idp.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "{External ID}"
        }
      }
    }
  ]
}

And the inline policy of the role should be

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sns:publish"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}
user_80122810
Related