Amplify Studio Permissions Error - Can't Create a New Project

On a super user account with full permissions, the initial step of creating a new Ampify Studio project fails with a lack of permissions. Created a second account with each of the requested permissions mapped out, still results in the same error.

Error Details:

You are missing the following permissions to deploy your Amplify backend successfully:

cognito-idp:DescribeUserPool
cognito-idp:DeleteUserPool
cognito-idp:CreateUserPool
cognito-idp:CreateUserPoolClient
cognito-idp:UpdateUserPool
cognito-idp:AdminSetUserPassword
cognito-identity:GetIdentityPoolRoles
cognito-identity:SetIdentityPoolRoles
cognito-identity:CreateIdentityPool
cognito-identity:DeleteIdentityPool
lambda:GetFunction
lambda:CreateFunction
lambda:AddPermission
lambda:DeleteFunction
s3:DeleteObjectVersion
cloudformation:ListStacks
appsync:GetIntrospectionSchema
appsync:GraphQL
appsync:UpdateApiKey
appsync:ListApiKeys
s3:PutObject
s3:GetObject
s3:ListBucket
s3:ListBucketVersions
s3:DeleteBucket
s3:DeleteBucketPolicy
s3:DeleteBucketWebsite
s3:DeleteObject
s3:GetBucketLocation
s3:ListAllMyBuckets
sts:AssumeRole
mobiletargeting:*
amplify:CreateApp
amplify:CreateBackendEnvironment
amplify:GetApp
amplify:GetBackendEnvironment
amplify:ListApps
amplify:ListBackendEnvironments
amplify:CreateBranch
amplify:GetBranch
amplify:UpdateApp
amplify:ListBranches
amplify:ListDomainAssociations
amplify:DeleteBranch
amplify:DeleteApp
amplify:DeleteBackendEnvironment
amplifybackend:*
cognito-idp:AdminAddUserToGroup
cognito-idp:AdminCreateUser
cognito-idp:CreateGroup
cognito-idp:DeleteGroup
cognito-idp:DeleteUser
cognito-idp:ListUsers
cognito-idp:AdminGetUser
cognito-idp:ListUsersInGroup
cognito-idp:AdminDisableUser
cognito-idp:AdminRemoveUserFromGroup
cognito-idp:AdminResetUserPassword
cognito-idp:AdminListGroupsForUser
cognito-idp:ListGroups
cognito-idp:AdminDeleteUser
cognito-idp:AdminListUserAuthEvents
cognito-idp:AdminConfirmSignUp
cognito-idp:AdminEnableUser
cognito-idp:AdminUpdateUserAttributes
cognito-idp:DescribeIdentityProvider
appsync:CreateApiKey
appsync:CreateDataSource
appsync:CreateFunction
appsync:CreateResolver
appsync:CreateType
appsync:DeleteApiKey
appsync:DeleteDataSource
appsync:DeleteFunction
appsync:DeleteResolver
appsync:DeleteType
appsync:GetDataSource
appsync:GetFunction
appsync:GetResolver
appsync:GetSchemaCreationStatus
appsync:GetType
appsync:ListDataSources
appsync:ListFunctions
appsync:ListGraphqlApis
appsync:ListResolvers
appsync:ListResolversByFunction
appsync:ListTypes
appsync:StartSchemaCreation
appsync:UpdateDataSource
appsync:UpdateFunction
appsync:UpdateResolver
appsync:UpdateType
appsync:TagResource
appsync:CreateGraphqlApi
appsync:DeleteGraphqlApi
appsync:GetGraphqlApi
appsync:ListTagsForResource
appsync:UpdateGraphqlApi
apigateway:DELETE
apigateway:GET
apigateway:PATCH
apigateway:POST
apigateway:PUT
cognito-identity:DescribeIdentity
cognito-identity:DescribeIdentityPool
cognito-identity:UpdateIdentityPool
cognito-idp:DeleteUserPoolClient
cognito-idp:DescribeUserPoolClient
cognito-idp:ListTagsForResource
cognito-idp:ListUserPoolClients
cognito-idp:UpdateUserPoolClient
cognito-identity:TagResource
cognito-idp:TagResource
lambda:GetFunctionConfiguration
lambda:InvokeAsync
lambda:InvokeFunction
lambda:RemovePermission
lambda:UpdateFunctionCode
lambda:UpdateFunctionConfiguration
lambda:ListTags
lambda:TagResource
lambda:UntagResource
lambda:AddLayerVersionPermission
lambda:CreateEventSourceMapping
lambda:DeleteEventSourceMapping
lambda:DeleteLayerVersion
lambda:GetEventSourceMapping
lambda:GetLayerVersion
lambda:ListEventSourceMappings
cloudformation:CreateChangeSet
cloudformation:CreateStack
cloudformation:DeleteStack
cloudformation:DescribeChangeSet
cloudformation:DescribeStackEvents
cloudformation:DescribeStackResource
cloudformation:DescribeStackResources
cloudformation:DescribeStacks
cloudformation:ExecuteChangeSet
cloudformation:GetTemplate
cloudformation:UpdateStack

invaderZYM
vor 2 Jahren
Did you run 'amplify configure'? this will ask you to create an IAM role that amplify will assume to run its commands. If you have that role you can you share the associated policy?
AWS-User-8364935
vor 2 Jahren
@invaderZYM I had been following the guided tutorial from the new Amplify Studio, but had skipped the local deploy/test steps (skip was given as an option). Running amplify commands from cli I was able to generate an empty project and enable Amplify Studio on that project. Unfortunately, the next steps of adding auth leads to additional errors. I am starting to think the Amplify Studio tutorial/documentation is not ready yet.
syumaK
vor 2 Jahren
can you share the tutorial link you are following, I'll be happy to replicate & open a PR on your behalf?

Themen

Frontend-Web & Mobile

Relevanter Inhalt

Wie behebe ich die Fehler „Invalid permissions on Lambda function“ (Ungültige Berechtigungen für die Lambda-Funktion) von API Gateway-REST-APIs?
AWS OFFICIALAktualisiert vor 2 Jahren
Wie konfiguriere ich meine Site-to-Site-VPN-Verbindung so, dass Tunnel A gegenüber Tunnel B bevorzugt wird?
AWS OFFICIALAktualisiert vor 2 Jahren
Wie behebe ich den AWS-KMS-Schlüsselrichtlinienfehler „Policy contains a statement with one or more invalid principals“ (Richtlinie enthält Aussage mit einem oder mehreren ungültigen Pinzipalen)?
AWS OFFICIALAktualisiert vor 2 Jahren
Wie verwende ich den lokalen Modus des Amazon SageMaker Python SDK mit SageMaker Studio?
AWS OFFICIALAktualisiert vor einem Jahr