lambda - 用户无权执行：cognito-idp:ListUsers

Question

I have encountered below error when I am trying to get all users in my user pool during testing in Lambda.

"errorType": "AccessDeniedException",
"errorMessage": "User: arn:aws:iam::123456789:user/xxxxx is not authorized to perform: cognito-idp:ListUsers on resource: arn:aws:cognito-idp:us-west-2:123456789:userpool/us-west-2_abcdefg",

My code in lambda:

var AWS = require('aws-sdk');

exports.handler = () => {
var params = {
  UserPoolId: 'us-west-2_abcdefg',
}

return new Promise((resolve, reject) => {
    AWS.config.update({ region: 'us-west-2', 'accessKeyId': 'accesskey', 'secretAccessKey': 'secretkey' });
    var cognitoidentityserviceprovider = new AWS.CognitoIdentityServiceProvider();
    cognitoidentityserviceprovider.listUsers(params, (err, data) => {
        if (err) {
            console.log(err);
            reject(err)
        }
        else {
            console.log("data", data);
            resolve(data)
        }
    })
});
};

I tried to add inline policy in IAM but still same error:

Lambda IAM Role

I knew I should update json for the policy, but Can someone provide detailed step to update the json policy?

Answer 1

I have encountered below error when I am trying to get all users in my user pool during testing in Lambda.

"errorType": "AccessDeniedException",
"errorMessage": "User: arn:aws:iam::123456789:user/xxxxx is not authorized to perform: cognito-idp:ListUsers on resource: arn:aws:cognito-idp:us-west-2:123456789:userpool/us-west-2_abcdefg",

My code in lambda:

var AWS = require('aws-sdk');

exports.handler = () => {
var params = {
  UserPoolId: 'us-west-2_abcdefg',
}

return new Promise((resolve, reject) => {
    AWS.config.update({ region: 'us-west-2', 'accessKeyId': 'accesskey', 'secretAccessKey': 'secretkey' });
    var cognitoidentityserviceprovider = new AWS.CognitoIdentityServiceProvider();
    cognitoidentityserviceprovider.listUsers(params, (err, data) => {
        if (err) {
            console.log(err);
            reject(err)
        }
        else {
            console.log("data", data);
            resolve(data)
        }
    })
});
};

I tried to add inline policy in IAM but still same error:

Lambda IAM Role

I knew I should update json for the policy, but Can someone provide detailed step to update the json policy?

Answer 2

It's just a permission issue. Follow the following steps :

I. CREATING THE POLICY (FOR PERMISSION)

1. Go to IAM console -> Policies -> Create Policy.
2. Choose "Cognito User Pools" Services.
3. Specify the desired actions for which you need permission for (List, Read, etc.)
4. Specify Resources.
5. Choose request conditions (optional).
6. Add Tags (Optional).
7. Give name and description of the policy.
8. Click on "Create Policy" button.

POLICY CREATED.

II. ADDING THE POLICY TO THE USER :

1. Go to IAM console -> Users.
2. Select the desired user.
3. In permissions tab, click on Add Permissions.
4. Click on "Attach existing policy directly".
5. Search for the policy you just created.
6. Click on "Add Permissions"

ISSUE IS RESOLVED.

Answer 3

Solution worked for me :

Step : 1 I have created a new policy with below json from IAM console

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "cognito-identity:MergeDeveloperIdentities",
            "cognito-identity:DescribeIdentityPool",
            "cognito-identity:ListIdentityPools",
            "cognito-identity:CreateIdentityPool",
            "cognito-identity:ListIdentities",
            "cognito-identity:GetOpenIdTokenForDeveloperIdentity",
            "cognito-identity:GetOpenIdToken",
            "cognito-identity:GetIdentityPoolRoles",
            "cognito-identity:GetPrincipalTagAttributeMap",
            "cognito-identity:GetId",
            "cognito-identity:LookupDeveloperIdentity",
            "cognito-identity:UnlinkDeveloperIdentity",
            "cognito-identity:ListTagsForResource",
            "cognito-identity:UpdateIdentityPool",
            "cognito-identity:UnlinkIdentity",
            "cognito-identity:DescribeIdentity",
            "cognito-identity:GetCredentialsForIdentity"
        ],
        "Resource": "*"
    }
]

}

Step: 2 Added the policy to ecsInstanceRole