lambda - user is not authorized to perform: cognito-idp:ListUsers

user_10686620 0
Viewed 13337

I have encountered below error when I am trying to get all users in my user pool during testing in Lambda.

"errorType": "AccessDeniedException",
"errorMessage": "User: arn:aws:iam::123456789:user/xxxxx is not authorized to perform: cognito-idp:ListUsers on resource: arn:aws:cognito-idp:us-west-2:123456789:userpool/us-west-2_abcdefg",

My code in lambda:

var AWS = require('aws-sdk');

exports.handler = () => {
var params = {
  UserPoolId: 'us-west-2_abcdefg',
}

return new Promise((resolve, reject) => {
    AWS.config.update({ region: 'us-west-2', 'accessKeyId': 'accesskey', 'secretAccessKey': 'secretkey' });
    var cognitoidentityserviceprovider = new AWS.CognitoIdentityServiceProvider();
    cognitoidentityserviceprovider.listUsers(params, (err, data) => {
        if (err) {
            console.log(err);
            reject(err)
        }
        else {
            console.log("data", data);
            resolve(data)
        }
    })
});
};

I tried to add inline policy in IAM but still same error: enter image description here

Lambda IAM Role enter image description here

I knew I should update json for the policy, but Can someone provide detailed step to update the json policy?

amazon-iam aws-lambda amazon-web-services
3 Answers

Your error cognito-idp:ListUsers is about Conginto User Pools, not Cognito User Identities. So your policy should be:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "cognito-idp:ListUsers",
            "Resource": "*"
        }
    ]
}
user_2488230

It's just a permission issue. Follow the following steps :

I. CREATING THE POLICY (FOR PERMISSION)

  1. Go to IAM console -> Policies -> Create Policy.
  2. Choose "Cognito User Pools" Services.
  3. Specify the desired actions for which you need permission for (List, Read, etc.)
  4. Specify Resources.
  5. Choose request conditions (optional).
  6. Add Tags (Optional).
  7. Give name and description of the policy.
  8. Click on "Create Policy" button.

POLICY CREATED.

II. ADDING THE POLICY TO THE USER :

  1. Go to IAM console -> Users.
  2. Select the desired user.
  3. In permissions tab, click on Add Permissions.
  4. Click on "Attach existing policy directly".
  5. Search for the policy you just created.
  6. Click on "Add Permissions"

ISSUE IS RESOLVED.

user_87779410

Solution worked for me :

Step : 1 I have created a new policy with below json from IAM console

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "cognito-identity:MergeDeveloperIdentities",
            "cognito-identity:DescribeIdentityPool",
            "cognito-identity:ListIdentityPools",
            "cognito-identity:CreateIdentityPool",
            "cognito-identity:ListIdentities",
            "cognito-identity:GetOpenIdTokenForDeveloperIdentity",
            "cognito-identity:GetOpenIdToken",
            "cognito-identity:GetIdentityPoolRoles",
            "cognito-identity:GetPrincipalTagAttributeMap",
            "cognito-identity:GetId",
            "cognito-identity:LookupDeveloperIdentity",
            "cognito-identity:UnlinkDeveloperIdentity",
            "cognito-identity:ListTagsForResource",
            "cognito-identity:UpdateIdentityPool",
            "cognito-identity:UnlinkIdentity",
            "cognito-identity:DescribeIdentity",
            "cognito-identity:GetCredentialsForIdentity"
        ],
        "Resource": "*"
    }
]

}

Step: 2 Added the policy to ecsInstanceRole

user_45723960
Related