AWS Cognito Invalid identity pool configuration

Question

I am using the AWS Javascript API and trying to get the assigned cognito id:

AWS.config.credentials.get(function(err) {
    if (!err) {
        console.log("Cognito Identity Id: " + AWS.config.credentials.identityId);
    }
});

Why does this result in a 400 error with the message below?

{"__type":"InvalidIdentityPoolConfigurationException","message":"Invalid identity pool configuration. Check assigned IAM roles for this pool."}

I have IAM roles configured for authenticated and non-authenticated users.

{
"Version": "2012-10-17",
"Statement": [{
    "Action": [
        "mobileanalytics:PutEvents",
        "cognito-sync:*"
    ],
    "Effect": "Allow",
    "Resource": [
        "*"
    ]
}]
}

Answer 1

The most common reason for this error is your roles aren't set up to trust your identity pool. You should confirm that the identity pool id listed in your trust relationships matches the identity pool you are using.

More info on trust relationships in Amazon Cognito can be found in our developer guide.

Answer 2

After some digging I realized that you must add the RoleArn and AccountId to your credentials.

Even though most of the documentation out there mention this as being enough:

AWS.config.credentials = new AWS.CognitoIdentityCredentials({
    IdentityPoolId: 'us-east-1:xxxxx-a87e-46ed-9519-xxxxxxx',
});

This was not enough.

I had to do this:

AWS.config.credentials = new AWS.CognitoIdentityCredentials({
    IdentityPoolId: 'us-east-1:xxxxx-a87e-46ed-9519-xxxxx',
    RoleArn: 'arn:aws:iam::xxxxx:role/Cognito_xxxxUsersUnauth_Role',
    AccountId: 'xxxxxxxxx', // your AWS account ID
});

You must mention the ARN of your Role for your identity pool.

The only doc that mention it right is this one.

The wrong ones:

• http://docs.aws.amazon.com/AWSJavaScriptSDK/guide/browser-configuring.html

• https://mobile.awsblog.com/post/TxBVEDL5Z8JKAC/Use-Amazon-Cognito-in-your-website-for-simple-AWS-authentication

• https://blogs.aws.amazon.com/javascript/post/TxTUNTVES4AL15/Authentication-in-the-Browser-with-Amazon-Cognito-and-Public-Identity-Providers

Maybe I'm missing something but this is certainly confusing.

Answer 3

Check the "Trust Relationship" section of the role that is assigned to your Identity Pool, authentication users. Make sure you have policies defining access to your Cognito pool.

The easiest way to get the requirement policy statements is,

1. Edit the pool
2. Create new role for identity pool
3. In IAM edit this role to copy the policy statements
4. Add these Trust Relationships to your required existing role

Answer 4

I checked the Trust Relationship of my roles configured for "Authenticated role" and "Unauthenticated role" for my identity pool more than once, but still the error occured. After reviewing my whole identity pool configuration I recognized that in

• Authentication providers
  • Cognito
    • Authenticated role selection

I have chosen "Choose role from token" and my wrong configured role was the one I attached to the cognito group for my users. So updating the Trust Relationship for this role fixed the problem.

Hope this helps someone :)

Answer 5

I encountered this error and my problem turned out to be that my user was assuming an unauthenticated role because I was returning AWSTask(result:nil) from the logins() function in my custom CognitoDeveloperIdentityProvider.

Answer 6

In my case, I am using SAML identity provider. The action in the IAM role policy should be: "Action": "sts:AssumeRoleWithSAML". But this is the root cause of the exception. I have to manually change it to "Action": "sts:AssumeRoleWithWebIdentity". It turns out any role created by the Cognito identity pool will use "Action": "sts:AssumeRoleWithWebIdentity". It won't check your identity provider type. I believe this is a bug.

Answer 7

Another - probably less common - reason: Make sure that you are actually using an identity pool and if not, remove the identity pool id from your aws-exports.js.

I was getting this error after adding federated sign ins to my user pool (not identity pool). For reasons unknown my config included an aws_cognito_identity_pool_id. Removing this id solved the error for me.

Answer 8

I had the same error when trying to retrieve files from S3 through my Identity pool users.

Solution: You can create a role in IAM for "Web Identity". Then provide your identity pool ID and add the permissions that you want the role to have, e.g. S3FullAccess. Then navigate back to Amazon Cognito Identity pools and assign the role you just created to the unauthrole or authrole. The users in the Identity pool should now be able to access the S3 resources

Answer 9

Another -way less probably scenario- is that either the provider or identityPoolId you are using is invalid. I spent hours debugging a missing ENV in my code.

Answer 10

Had this issue, after several hours of checking our what the problem could be, found out that the Trust Policy is actually missing this line sts:TagSession in the Action List so eventually the Authenticated Trust Policy is as defined below:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": [
        "sts:AssumeRoleWithWebIdentity",
        **"sts:TagSession"** //this does the trick for me
      ],
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "{IDENTITY_POOL_ID}"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "authenticated"
        }
      }
    }
  ]
}