CognitoIdentityCredentials is not authorized to perform: textract:AnalyzeExpense even when the Role has the permission AmazonTextractFullAccess

Question

I am trying to create a receipt scanner class to get the total price of a receipt as one of the functions of my app. I create an identity pool for anonymous guests with the role Texttract_API_Users. The role has the permission AmazonTextractFullAccess.

I run textract:AnalyzeExpense on an receipt to get the total price, however I get the error:  
User: arn:aws:sts::xx050451363103:assumed-role/Texttract_API_Users/CognitoIdentityCredentials is not authorized to perform: textract:AnalyzeExpense because no session policy allows the textract:AnalyzeExpense action (Service: AmazonTextract; Status Code: 400; Error Code: AccessDeniedException; Request ID: 9552e33d-7750-4faf-8228-3f5f778944e3)

When I run textract:DetectDocumentText however, it works. What am I doing wrong?

Also does anybody know what is sts and CognitoIdentityCredentials?

re:Post Agent · Answer

It appears that there might be an issue with the trust relationship or the role configuration for your Cognito Identity Pool. Even though you've assigned the AmazonTextractFullAccess policy to the Texttract_API_Users role, there could be additional factors preventing the execution of the AnalyzeExpense action.

Here are a few things to check and consider:

1. Verify that the trust relationship for the Texttract_API_Users role is correctly set up to allow Amazon Cognito to assume the role. The trust policy should include the Cognito Identity service principal and your specific Identity Pool ID.

2. Make sure that the Identity Pool is correctly configured to use the Texttract_API_Users role for authenticated or unauthenticated users, depending on your use case.

3. Check if there are any session policies or scope-down policies applied to the role that might be restricting access to specific Textract actions.

4. Ensure that the AmazonTextractFullAccess policy hasn't been modified or overridden by other more restrictive policies attached to the role.

5. Verify that the region you're using for Textract operations matches the region where your Identity Pool and IAM role are set up.

Regarding your question about STS and CognitoIdentityCredentials:

STS stands for AWS Security Token Service. It's a web service that enables you to request temporary, limited-privilege credentials for AWS Identity and Access Management (IAM) users or for users you authenticate (federated users).

CognitoIdentityCredentials is likely referring to the temporary credentials obtained through Amazon Cognito Identity Pools. When a user authenticates through Cognito (or as an unauthenticated guest), Cognito uses STS to assume the specified IAM role and provide temporary credentials to the user. These credentials are then used to access AWS services like Textract.

The fact that DetectDocumentText works but AnalyzeExpense doesn't suggests that there might be a more granular permission issue or a misconfiguration in how the role or session policies are set up. Double-check all aspects of your IAM and Cognito configuration to ensure proper permissions are granted for the AnalyzeExpense action.  
**Sources**  
[IAM roles - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/iam-roles.html)  
[Fine grained access control with cognito identity and custom claims | AWS re:Post](https://repost.aws/questions/QU4aQKcYizQ5uiD_rtHYQq1Q/fine-grained-access-control-with-cognito-identity-and-custom-claims)  
[The OIDC token authenticated by the identity pool fails to obtain the corresponding authorization role credentials | AWS re:Post](https://repost.aws/questions/QUlE1FeyOwRfebctwG77SBjw/the-oidc-token-authenticated-by-the-identity-pool-fails-to-obtain-the-corresponding-authorization-role-credentials)

CognitoIdentityCredentials is not authorized to perform: textract:AnalyzeExpense even when the Role has the permission AmazonTextractFullAccess

Add your answer

Relevant content