**Issue: Unauthorized errors with Kinesis Video Streams WebRTC (Signaling Channel)**

There are a few issues with your IAM policy that could be causing the unauthorized errors when working with Kinesis Video Streams WebRTC signaling channels.

First, let's address the resource ARN format. For Kinesis Video Streams signaling channels, the correct format is:

arn:aws:kinesisvideo:<region>:<account-id>:channel/<channel-name>/<creation-time>

However, when you're creating a new channel or working with multiple channels, using a wildcard is appropriate. The issue with your current policy is that the resource format doesn't match what Kinesis Video Streams expects.

Here are the key problems and solutions:

1. Resource ARN format issue: Your current resource specification arn:aws:kinesisvideo:<region>:<account-id>:channel/doorbell_poc/* is not correctly formatted. For creating or describing a channel, you need either the full ARN with channel ID or a properly formatted wildcard pattern.

2. Missing permissions: For operations like CreateSignalingChannel, the resource doesn't exist yet, so you need to use a broader resource pattern.

3. Policy structure: You might need to separate permissions for existing resources versus creating new ones.

For testing purposes, you could try this modified policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cognito-identity:GetCredentialsForIdentity"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"kinesisvideo:CreateSignalingChannel",
"kinesisvideo:ListSignalingChannels"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"kinesisvideo:DescribeSignalingChannel",
"kinesisvideo:GetSignalingChannelEndpoint",
"kinesisvideo:GetIceServerConfig",
"kinesisvideo:SendAlexaOfferToMaster",
"kinesisvideo:ConnectAsMaster",
"kinesisvideo:ConnectAsViewer",
"kinesisvideo:DeleteSignalingChannel",
"kinesisvideo:TagStream",
"kinesisvideo:GetDataEndpoint"
],
"Resource": "arn:aws:kinesisvideo:*:*:channel/*"
}
]
}

This policy:

1. Allows creating channels with a wildcard resource (since the resource doesn't exist yet)
2. Uses a broader pattern for existing channels to avoid ARN format issues
3. Separates permissions logically based on resource existence

Once you confirm everything works, you can tighten the permissions by specifying exact regions, account IDs, and channel names as needed.

Make sure to update the policy attached to the Cognito Identity Pool role, and remember that IAM policy changes can take a few minutes to propagate.
Sources
User: arn:aws:sts::<ACCOUNT_ID>:assumed-role/<ROLE_NAME>/CognitoIdentityCredentials is not authorized to perform: kinesisvideo:GetSignalingChannelEndpoint on resource: arn:aws:kinesisvideo:<REGION> | AWS re:Post
Not authorized to perform kinesisvideo:GetDataEndpoint despite policy permissions | AWS re:Post

The unauthorized errors occur because Kinesis Video Streams is not included in Cognito's default scope-down policy for unauthenticated users in the enhanced flow.

Correct Solution

1. Enable Basic (Classic) Authentication Flow in your Cognito Identity Pool:

{
    "IdentityPoolId": "your-identity-pool-id",
    "AllowClassicFlow": true
}

2. Use the correct IAM Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kinesisvideo:DescribeSignalingChannel",
                "kinesisvideo:GetSignalingChannelEndpoint",
                "kinesisvideo:GetIceServerConfig",
                "kinesisvideo:ConnectAsMaster",
                "kinesisvideo:ConnectAsViewer"
            ],
            "Resource": "arn:aws:kinesisvideo:${Region}:${AccountId}:channel/${ChannelName}"
        }
    ]
}

3. Correct Trust Policy for the IAM Role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "cognito-identity.amazonaws.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "cognito-identity.amazonaws.com:aud": "your-identity-pool-id"
                },
                "ForAnyValue:StringLike": {
                    "cognito-identity.amazonaws.com:amr": "authenticated"
                }
            }
        }
    ]
}

Key Points

• Use Basic (Classic) flow instead of Enhanced flow
• Use the correct ARN format without wildcards
• Ensure proper trust relationships are configured
• For production, always use authenticated users instead of unauthenticated access

This solution provides the minimum required configuration to get Kinesis Video Streams WebRTC working with Amazon Cognito authentication.

References

1. Stack Overflow: Cognito Identity Credentials Authorization for Kinesis Video
2. AWS Documentation: IAM Roles with Amazon Cognito