Cannot get developer authenticated identities to work

Question

We have setup an Identity Pool with our own Custom provider. On our backend (node sdk v2), we are calling .getOpenIdTokenForDeveloperIdentity() and we are successfully getting back OpenID tokens for our users.  
  
But then, both with iOS SDK (using AWSCore from Mobile SDK) and with a JS Client, we are receiving this error when calling .getCredentialsForIdentity():

```
Invalid identity pool configuration. Check assigned IAM roles for this pool
```

Here is the code:

```javascript
await Cognito.getCredentialsForIdentity({
      IdentityId: identity,  // received from our backend
      Logins: {
        'cognito-identity.amazonaws.com': openIdToken, // received from our backend
      },
    }).promise();
```

Role assumed by authenticated users has this Trust Relationship set:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": ""
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "authenticated"
        }
      }
    }
  ]
}
```

And the OpenID Token generated with the .getOpenIdTokenForDeveloperIdentity() API looks like this:

```
{
  "sub": "",
  "aud": "",
  "amr": [
    "authenticated",
    "",
    ":::"
  ],
  "https://aws.amazon.com/tags": {
    "principal_tags": {
      "userType": ["client"]
    }
  },
  "iss": "https://cognito-identity.amazonaws.com",
  "https://cognito-identity.amazonaws.com/identity-pool-arn": "",
  "exp": 1615736591,
  "iat": 1615650191
}
```

We can't figure out what we are doing wrong. We believe to have done all steps as they are documented...

Answer

After almost a day.... the problem turned out to be "PrincipalTags".

```javascript
const cognitoResponse = await Cognito.getOpenIdTokenForDeveloperIdentity({
    IdentityPoolId: '',
    IdentityId: '',
    Logins: {
      '': userId,
    },
    PrincipalTags: { // THIS IS THE ISSUE
      'userType': 'client',
    },
    TokenDuration: 86400,
  }).promise();
```

I don't know why, but I got it working by removing it ...

Answer

I also faced the same issue.
It seems that `sts:TagSession` must be allowed to `getCredentialsForIdentity.`
There are details in the document below.

https://docs.aws.amazon.com/en_us/IAM/latest/UserGuide/id_session-tags.html

Answer

You have to modify trust relationships for the IAM role that linked to Identity pools
1. Access to roles
2. Search & open for the role that linked to your Identity pools
3. Click on "trust relationships" tab
4. Add the new action `sts:TagSession`
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "cognito-identity.amazonaws.com"
            },
            "Action": [
                "sts:AssumeRoleWithWebIdentity",
                "sts:TagSession" <---- this one
            ],
            "Condition": {
                "StringEquals": {
                    "cognito-identity.amazonaws.com:aud": "us-east-1:xxxxxx-xxxx-xxxx-xxxx-xxxxxxxx"
                },
                "ForAnyValue:StringLike": {
                    "cognito-identity.amazonaws.com:amr": "authenticated"
                }
            }
        }
    ]
}
```

Reference:
https://docs.aws.amazon.com/cognito/latest/developerguide/using-attributes-for-access-control-policy-example.html

Cannot get developer authenticated identities to work

Relevant content