Cognito / IAM Policies & S3 Get Item

Question

I am trying to integrate S3 and Cognito into my iOS application, not yet successfully. I believe the error is related to my IAM policy for Auth and Unauth users. So my policy is:

{ "Version": "2012-10-17", "Statement": [{ "Effect":"Allow", "Action":"cognito-sync:*", "Resource":["arn:aws:cognito-sync:us-east-1:XXXXXXXXXXXX:identitypool/${cognito-identity.amazonaws.com:aud}/identity/${cognito-identity.amazonaws.com:sub}/*"] }, { "Effect":"Allow", "Action": "s3:*", "Resource": ["arn:aws:s3:::my_bucket", "arn:aws:s3:::my_bucket/*"] } ] } 

here I call S3:

  AWSS3GetObjectRequest *getObjectRequest = [[AWSS3GetObjectRequest alloc] init]; getObjectRequest.key = KEY; getObjectRequest.bucket = BUCKET; //default service has been configured previously AWSS3 *s3 = [[AWSS3 new] initWithConfiguration:[AWSServiceManager defaultServiceManager].defaultServiceConfiguration]; [[s3 getObject:getObjectRequest] continueWithBlock:^id(BFTask *task) { if(task.error) { NSLog(@"Error: %@",task.error); } else { NSLog(@"Got File"); NSData *data = [task.result body]; NSString *urlString = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding]; NSURL *url = [[NSURL alloc] initWithString:urlString]; if ([[UIApplication sharedApplication] canOpenURL:url]) { [[UIApplication sharedApplication] openURL:url]; } } return nil; }]; 

and here is the error:

Error: Domain error = com.amazonaws.AWSSTSErrorDomain Code = 0 "AccessDenied - not allowed to execute sts: AssumeRoleWithWebIdentity" UserInfo = 0x10a23e0a0 {NSLocalizedDescription = AccessDenied - not allowed to execute sts: AssumeRoleWithWebIdentity}

So what am I doing wrong?

Answer 1

The error you are experiencing

 Not authorized to perform sts:AssumeRoleWithWebIdentity 

Due to an error in your trust policy, not your access policy.

Is this the role that was created as part of the Cognito configuration wizard? Did you somehow change the role? The role created by the Cognito console is tied to the specific identity pool with which it was created. Make sure that you use the role created using the identity pool that you use in your application.