How do I resolve the "Access Denied" error when I try to create a user pool in Amazon Cognito?

Resolution

The "Access Denied" error occurs when your AWS Identity and Access Management (IAM) user or role doesn't have the required permissions to create and manage Amazon Cognito resources. To resolve this issue, attach the AmazonCognitoPowerUser IAM policy to your IAM user or role.

Complete the following steps:

1. Open the IAM console.
2. In the navigation pane, choose Users to grant permissions to an IAM user. Or, choose Roles to grant permissions to an IAM role.
3. Select the IAM user or role.
4. On the Permissions tab, expand the Add permissions section, and then choose Attach existing policies directly.
5. In the search box, enter AmazonCognitoPowerUser.
6. Select the check box for the AmazonCognitoPowerUser policy.
7. Choose Next: Review.
8. Review the policy, and then choose Add permissions.

Note: The AmazonCognitoPowerUser managed policy provides full access to Amazon Cognito resources. To limit access, create a custom IAM policy with only the required permissions. For more information, see Amazon managed policies for Amazon Cognito.

If you create an Amazon Cognito user pool with Short Message Service (SMS) configuration, then also attach the following sample policy to your IAM user or role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CognitoServiceRoleManagement",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole",
                "iam:CreateRole",
                "iam:AttachRolePolicy"
            ],
            "Resource": "arn:aws:iam:444455556666:role/service-role/CognitoIdpSNSServiceRole"
        },
        {
            "Sid": "CognitoServiceRolePolicyCreation",
            "Effect": "Allow",
            "Action": [
                "iam:CreatePolicy"
            ],
            "Resource": "arn:aws:iam:444455556666:policy/service-role/Cognito-*"
        }
    ]
}

Note: Replace 444455556666 with your AWS account ID.

Related information

Amazon Cognito user pools

Signing up and confirming user accounts