# Create a Cognito Identity Pool

**URL:** <https://discourse.sst.dev/t/create-a-cognito-identity-pool/135>\
**Category:** Chapter Comments\
**Created:** [May 9, 2018, 8:00pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135 "2018-05-09T20:00:42Z")\
**Posts on this page:** 8\
**Page:** 4

<div class="post-metadata">

**Author:** ![jaychandran](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jaychandran/32/896_2.png) [@jaychandran](https://discourse.sst.dev/u/jaychandran)\
**Post date:** [June 26, 2020, 3:54am UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/62 "2020-06-26T03:54:45Z")

</div>

> [@jaychandran](#):
>
> `"Resource": "arn:aws:s3:::abc-notes-app-uploads/private/${cognitoidentity.amazonaws.com:sub}/*"`

Sorry forgot to update. I had it figured out - I had the arn resource name missing a dash in the name `cognito-identity.amazonaws.com:sub`

---

<div class="post-metadata">

**Author:** ![HannahStahl](https://avatars.discourse-cdn.com/v4/letter/h/ed655f/32.png) [@HannahStahl](https://discourse.sst.dev/u/HannahStahl)\
**Post date:** [July 2, 2020, 2:32am UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/63 "2020-07-02T02:32:50Z")

</div>

@jayair Could you share some code that shows how to set up different user groups? It seems like right now the code in the tutorial is set up to allow any authenticated user access to any resource. But I would love to separate users into multiple groups, where different groups have different permissions in terms of what data they can edit. Thank you in advance for your help!

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [July 2, 2020, 9:21pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/64 "2020-07-02T21:21:59Z")

</div>

Glad you figured it out. Did you get the API ones working as well?

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [July 2, 2020, 9:22pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/65 "2020-07-02T21:22:52Z")

</div>

This one is tricky. You can use User Pool Groups but it isn’t very easy to use. Depending on the type of data, I would suggest managing these roles in your own code.

---

<div class="post-metadata">

**Author:** ![jaychandran](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jaychandran/32/896_2.png) [@jaychandran](https://discourse.sst.dev/u/jaychandran)\
**Post date:** [July 3, 2020, 12:19pm UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/66 "2020-07-03T12:19:27Z")

</div>

Yes Jay, API is working as well! 😊 😊

---

<div class="post-metadata">

**Author:** ![zencoder](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/zencoder/32/1000_2.png) [@zencoder](https://discourse.sst.dev/u/zencoder)\
**Post date:** [December 8, 2020, 10:11am UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/67 "2020-12-08T10:11:22Z")

</div>

Hi, there seems to be an error in the tutorial, in the final “Resource” block of the of the IAM policy for `Cognito_notesAuth_Role`. The final block’s resource arn should have a trailing `/*` rather than a trailing `/*/*/*`. Here’s the corrected policy block:

```auto
    {
      "Effect": "Allow",
      "Action": [
        "execute-api:Invoke"
      ],
      "Resource": [
        "arn:aws:execute-api:YOUR_API_GATEWAY_REGION:*:YOUR_API_GATEWAY_ID/*"
      ]
    }

```

This error in the tutorial seems to lead to a common cryptic error in the ‘Test the APIs’ section ([https://serverless-stack.com/chapters/test-the-apis.html](https://serverless-stack.com/chapters/test-the-apis.html)).

---

<div class="post-metadata">

**Author:** ![jamiebdavis](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jamiebdavis/32/1054_2.png) [@jamiebdavis](https://discourse.sst.dev/u/jamiebdavis)\
**Post date:** [December 15, 2020, 9:46am UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/68 "2020-12-15T09:46:47Z")

</div>

This solved my issue, thanks!

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [January 3, 2021, 12:47am UTC](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135/69 "2021-01-03T00:47:53Z")

</div>

Hmm that’s weird. What was the error you got?

[Previous page](https://discourse.sst.dev/t/create-a-cognito-identity-pool/135.md?page=3)