Cognito User Pool Cannot be Deleted from AWS Console

Question

I have a user pool in Cognito with no users in it. When I try to delete the user pool from the AWS console, the AWS console throws the following error.

Failed to deactivate deletion protection
code: InvalidSmsRoleTrustRelationshipException
message: Role does not have a trust relationship allowing Cognito to assume the role

I do not understand what I should do to delete the user pool

Gunasekaran, Makendran · Accepted Answer

I would like to inform you that, the error "InvalidSmsRoleTrustRelationshipException" you are facing is usually caused due to the "Trust Relationship" of the IAM role, which does not allow Cognito service to use that IAM role. So, in order to resolve the issue, the easiest way would be to visit the "Newer" version of the Cognito console, then follow the following steps:

1) In the new console, select the user pool which you want to update.
2) Go to the "Authentication methods" tab and under the "SMS" section click "Edit".
3) Then, select the radio button "Create a new IAM role" and input a unique name for the IAM role.
4) Finally, click "Save changes", wait few seconds on the same page for role to be created successfully.

Once the role is created, it will be assigned to your user pool automatically.

Also, in case you want to use an existing IAM role and want to update it using the console or CLI, then you would first have to edit the IAM role’s trust relationship to have following permissions:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": "cognito-idp.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```
For more details around steps to edit the trust relationship of the role using console, please refer the documentation [1].

Additionally, I would also recommend you to please check using the new Cognito console under the "Settings" tab, if the "Deletion protection" feature is enabled for the user pool or not. In case this is enabled, I would request you to please disable this before trying to delete the user pool [2].

Once the above steps are completed, you should be able to delete your use pools. If the issue persist please do let me know.

[1] https://docs.aws.amazon.com/directoryservice/latest/admin-guide/edit_trust.html

[2] https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-deletion-protection.html

re:Post Agent · Answer

The error you're encountering suggests that there's an issue with the SMS role trust relationship for your Cognito User Pool, which is preventing you from deleting it. However, to address your primary concern of deleting the user pool, you need to follow these steps:

1. First, you need to deactivate the deletion protection for your user pool. Deletion protection is a feature that prevents accidental deletion of user pools.

2. To deactivate deletion protection, go to the Amazon Cognito console, navigate to your user pool, and find the "Deletion protection" container in the "Settings" menu.

3. Once you've deactivated deletion protection, you should be able to delete the user pool.

If you're still encountering issues after deactivating deletion protection, you may need to address the SMS role trust relationship error. This could involve updating the IAM role associated with your user pool to ensure it has the correct trust relationship with Cognito.

If you continue to face difficulties, you might want to consider using the AWS CLI or SDK to delete the user pool. When using these methods, you would first need to change the 'DeletionProtection' parameter to 'Inactive' using an UpdateUserPool request, and then you can proceed with the DeleteUserPool request.

Remember, once you delete a user pool, it's no longer visible or operational in your AWS account. However, Amazon Cognito retains deleted user pools in an inactive state for 14 days before beginning the cleanup process. If you accidentally delete a user pool, you can contact AWS Support within this 14-day period for restoration assistance.  
**Sources**  
[User pool deletion protection - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-deletion-protection.html)  
[DeleteUserPool - Amazon Cognito User Pools](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPool.html)

Cognito User Pool Cannot be Deleted from AWS Console

Add your answer

Relevant content