# Create a Cognito Identity Pool

**URL:** <https://discourse.sst.dev/t/create-a-cognito-identity-pool/135>\
**Category:** Chapter Comments\
**Created:** [May 9, 2018, 8:00pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135 "2018-05-09T20:00:42Z")\
**Posts on this page:** 20\
**Page:** 3

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [February 10, 2020, 6:59pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/42 "2020-02-10T18:59:31Z")

</div>

Did this end up causing an issue for you?

---

<div class="post-metadata">

**Author:** ![alex](https://avatars.discourse-cdn.com/v4/letter/a/db5fbb/32.png) [@alex](https://discourse.sst.dev/u/alex)\
**Post date:** [April 16, 2020, 3:05pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/43 "2020-04-16T15:05:05Z")

</div>

I got this _“ **Invalid UserPoolId format** ”_ at this step.  
Tried to follow every minimal steps until now but havent found out how to get over it.

---

<div class="post-metadata">

**Author:** ![chris-t](https://avatars.discourse-cdn.com/v4/letter/c/e56c9b/32.png) [@chris-t](https://discourse.sst.dev/u/chris-t)\
**Post date:** [April 16, 2020, 5:01pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/44 "2020-04-16T17:01:09Z")

</div>

Hi there, I seem to be getting two errors while writing the policy document.

 ![Screen Shot 2020-04-16 at 1.00.36 PM](https://canada1.discourse-cdn.com/flex032/uploads/serverless_stack/original/1X/eaee99574852ff0e0be8d5f3e643b2f263deff7b.png)

Does anyone know how to solve it? I double checked everything.

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [April 25, 2020, 4:53pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/45 "2020-04-25T16:53:51Z")

</div>

Is your policy valid JSON? Can you post it here?

---

<div class="post-metadata">

**Author:** ![chris-t](https://avatars.discourse-cdn.com/v4/letter/c/e56c9b/32.png) [@chris-t](https://discourse.sst.dev/u/chris-t)\
**Post date:** [April 25, 2020, 5:09pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/46 "2020-04-25T17:09:12Z")

</div>

```json
   {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "mobileanalytics:PutEvents",
        "cognito-sync:*",
        "cognito-identity:*"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": [
        "arn:aws:s3:::notes-app-for-file-uploads/private/${cogni
identity.amazonaws.com:sub}/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "execute-api:Invoke"
      ],
      "Resource": [
        "arn:aws:execute- api:us-east-2:*:he545pdhb0/*/*/*"
      ]
    }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [April 25, 2020, 5:27pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/47 "2020-04-25T17:27:35Z")

</div>

> [@chris-t](#):
>
> `arn:aws:execute- api:us-east-2:*:he545pdhb0/*/*/*`

How come there is a space there?

---

<div class="post-metadata">

**Author:** ![chris-t](https://avatars.discourse-cdn.com/v4/letter/c/e56c9b/32.png) [@chris-t](https://discourse.sst.dev/u/chris-t)\
**Post date:** [April 25, 2020, 5:39pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/48 "2020-04-25T17:39:36Z")

</div>

I somehow got an error, then after I clicked “Allow” again, it says my role is already created…

huh, is it possible to have some errors with my policy, and still create a role?

---

<div class="post-metadata">

**Author:** ![chris-t](https://avatars.discourse-cdn.com/v4/letter/c/e56c9b/32.png) [@chris-t](https://discourse.sst.dev/u/chris-t)\
**Post date:** [April 25, 2020, 5:47pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/49 "2020-04-25T17:47:09Z")

</div>

![Screen Shot 2020-04-25 at 1.46.47 PM](https://canada1.discourse-cdn.com/flex032/uploads/serverless_stack/original/1X/f89762a397aba6bd2330626d5fa9bacf2b5cac7f.png)  
Here’s what it looks like.

---

<div class="post-metadata">

**Author:** ![wesseldehaas](https://avatars.discourse-cdn.com/v4/letter/w/7ba0ec/32.png) [@wesseldehaas](https://discourse.sst.dev/u/wesseldehaas)\
**Post date:** [April 28, 2020, 9:02pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/50 "2020-04-28T21:02:02Z")

</div>

Hi,  
Thanks for great resource. I just got stuck on testing the identify pool. I get the following message:

```auto
npx: installed 105 in 7.555s
Authenticating with User Pool
Getting temporary credentials
Making API request
{
  status: 500,
  statusText: 'Internal Server Error',
  data: {
    error: 'User: arn:aws:sts::173915777836:assumed-role/wesnotes-app-api-prod-eu-central-1-lambdaRole/wesnotes-app-api-prod-create is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:eu-central-1:173915777836:table/notes'
  }
}

```

I went into IAM and checked the policy entered for the authorised role, deleted it and re-entered it. Result still same.

Where should I look next?

Grateful for your help.

regards,

Wessel

---

<div class="post-metadata">

**Author:** ![wesseldehaas](https://avatars.discourse-cdn.com/v4/letter/w/7ba0ec/32.png) [@wesseldehaas](https://discourse.sst.dev/u/wesseldehaas)\
**Post date:** [April 29, 2020, 5:29am UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/51 "2020-04-29T05:29:59Z")

</div>

sorry for bothering you. Solved it myself:  
There was still a reference to a US region in serverless.yml (in the iamRoleStatements) that I had to replace by eu-central-1.

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [May 3, 2020, 1:11am UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/52 "2020-05-03T01:11:09Z")

</div>

Hmm so you created it without any spaces in the API Gateway resource?

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [May 3, 2020, 1:11am UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/53 "2020-05-03T01:11:44Z")

</div>

Ah. Glad you figure it out. Thanks for reporting back!

---

<div class="post-metadata">

**Author:** ![chris-t](https://avatars.discourse-cdn.com/v4/letter/c/e56c9b/32.png) [@chris-t](https://discourse.sst.dev/u/chris-t)\
**Post date:** [May 9, 2020, 1:09am UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/54 "2020-05-09T01:09:50Z")

</div>

i tried it without the bottom, but then it says the 2 errors on the bottom, does that mean it’s created?

---

<div class="post-metadata">

**Author:** ![davemrunal](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@davemrunal](https://discourse.sst.dev/u/davemrunal)\
**Post date:** [May 11, 2020, 12:40am UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/55 "2020-05-11T00:40:54Z")

</div>

Can I configure the below access to be emailId of the logged in user instead of the authenticated user’s federated identity ID?

```auto
      "Resource": [
        "arn:aws:s3:::YOUR_S3_UPLOADS_BUCKET_NAME/private/${cognito-identity.amazonaws.com:sub}/*"
      ]

```

Basically i am going to have a profile detail form in my app where i will store the profile for each user in the dynamoDB table. In the `create` endpoint, I have already changed the userId from `userId: event.requestContext.identity.cognitoIdentityId` to `emailId`

---

<div class="post-metadata">

**Author:** ![jaychandran](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jaychandran/32/896_2.png) [@jaychandran](https://discourse.sst.dev/u/jaychandran)\
**Post date:** [June 13, 2020, 4:42pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/56 "2020-06-13T16:42:43Z")

</div>

Hi,

Can someone please point out what could be wrong? When I try the npx aws-api-gateway-cli-test I get the below error:

> { status: 403,  
> statusText: ‘Forbidden’,  
> data:  
> { message:  
> ‘User: arn:aws:sts::1111111111111:assumed-role/Cognito\_notesAuth\_Role/CognitoIdentityCredentials is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:ap-south-1:\*\*\*\*\*\*\*\*1111:abcdef12fd/prod/POST/notes’ } }

I tried the API simulator in AWS, there also I get denied i.e. "denied implicitly denied " error. Below is the Cognito Policy

> ```
> {
> "Version": "2012-10-17",
> "Statement": [
> {
> "Sid": "VisualEditor0",
> "Effect": "Allow",
> "Action": [
> "cognito-identity:*",
> "mobileanalytics:PutEvents",
> "cognito-sync:*"
> ],
> "Resource": "*"
> },
> {
> "Sid": "VisualEditor1",
> "Effect": "Allow",
> "Action": "execute-api:Invoke",
> "Resource": ["arn:aws:execute-api:ap-south-1:*:abcdef12fd/*/*/*"]
> },
> {
> "Sid": "VisualEditor2",
> "Effect": "Allow",
> "Action": "s3:*",
> "Resource": "arn:aws:s3:::abc-notes-app-uploads/private/${cognitoidentity.amazonaws.com:sub}/*"
> }
> ]
> }
> 
> ```

I checked the [Redirecting…](https://serverless-stack.com/chapters/debugging-serverless-api-issues.html) as well.

Thanks!  
Jay

---

<div class="post-metadata">

**Author:** ![jaychandran](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jaychandran/32/896_2.png) [@jaychandran](https://discourse.sst.dev/u/jaychandran)\
**Post date:** [June 13, 2020, 5:44pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/57 "2020-06-13T17:44:38Z")

</div>

I even tried having only the execute-api in the Policy and simulation still fails.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:ap-south-1:*:abcdef12fd/*/*/*"
        }
    ]
}
```

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [June 13, 2020, 10:33pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/58 "2020-06-13T22:33:51Z")

</div>

Hmm I’m not entirely sure, since that is managed internally by AWS Amplify. If you want to manage uploads yourself, you could directly use the AWS JS SDK. That way you can create the directories you want.

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [June 13, 2020, 10:35pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/59 "2020-06-13T22:35:13Z")

</div>

Can you try setting the Resource as `*`? Just as a test? Than you’ll know if there is a problem with the Resource format?

---

<div class="post-metadata">

**Author:** ![jaychandran](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jaychandran/32/896_2.png) [@jaychandran](https://discourse.sst.dev/u/jaychandran)\
**Post date:** [June 14, 2020, 4:12am UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/60 "2020-06-14T04:12:15Z")

</div>

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "execute-api:Invoke",
            "Resource": "*"
        }
    ]
}

```

The above works and the below fails.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:*:*:*/*/*/*"
        }
    ]
}

```

and the below one fails as well.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:ap-south-1:1111111111111:abcdef12fd/*/*/*"
        }
    ]
}
```

---

<div class="post-metadata">

**Author:** ![jaychandran](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jaychandran/32/896_2.png) [@jaychandran](https://discourse.sst.dev/u/jaychandran)\
**Post date:** [June 15, 2020, 4:31am UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/61 "2020-06-15T04:31:59Z")

</div>

@jayair How do I make sure it works with the ARN resource? What is that I am doing wrong ?

[Previous page](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135.md?page=2)

[Next page](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135.md?page=4)