Intermittent "InvalidIdentityPoolConfigurationException" Error for Few Requests in AWS Identity Pool

Question

For the past few days, we have been encountering a persistent and intermittent issue with our AWS Identity Pool setup, and we are seeking your valuable insights and expertise to help us resolve this problem.

Problem Description:
Our AWS Identity Pool is responsible for managing access to our web and mobile applications. However, we have observed that only a few requests are failing with the following error message:

```
{'Error': {'Message': 'Invalid identity pool configuration. Check assigned IAM roles for this pool.', 'Code': 'InvalidIdentityPoolConfigurationException'}, 'ResponseMetadata': {'RequestId': 'd2a2b7e6-49bc-4b23-b269-0a90879c47a4', 'HTTPStatusCode': 400, 'HTTPHeaders': {'date': 'Thu, 20 Jul 2023 17:45:29 GMT', 'content-type': 'application/x-amz-json-1.1', 'content-length': '143', 'connection': 'keep-alive', 'x-amzn-requestid': 'd2a2b7e6-49bc-4b23-b269-0a90879c47a4', 'strict-transport-security': 'max-age=31536000; includeSubDomains', 'x-amzn-errortype': 'InvalidIdentityPoolConfigurationException:', 'x-amzn-errormessage': 'Invalid identity pool configuration. Check assigned IAM roles for this pool.'}, 'RetryAttempts': 0}, 'message': 'Invalid identity pool configuration. Check assigned IAM roles for this pool.'}
```

The majority of requests, including those with the same parameters and AWS resources, are succeeding without any issues.

Our Request:
We have already checked and verified the IAM roles associated with the identity pool, and they appear to be correctly configured with the necessary permissions. Additionally, we have ensured that the Identity Pool ID is accurate in all requests.

Despite our efforts, we have been unable to pinpoint the exact root cause of these intermittent failures. Therefore, we kindly request the community's expertise and suggestions to assist us in diagnosing and resolving this issue.

If anyone has encountered similar issues in the past or has any ideas about potential solutions, we would be immensely grateful for your guidance.

Thank you for your time and assistance.

Answer

Hello,

The error can be returned if the trust-relationship[1] of the authenticated IAM role does not allow identities from the identity pool to assume the role.
It can also be returned if you have configured Attribute-based Access Control for your Identity Pool but the trust-relationship of the IAM role does not include the permission "sts:TagSession"[2].

However, as it is confirmed that the IAM roles are correctly configured for the Identity Pool, we would require details that are non-public information, in order to pinpoint the cause of the exception being returned. As such, please open a support case with AWS using the following link:
https://console.aws.amazon.com/support/home#/case/create

[1] Role trust and permissions - https://docs.aws.amazon.com/cognito/latest/developerguide/role-trust-and-permissions.html 
[2] Using attributes for access control policy example - https://docs.aws.amazon.com/cognito/latest/developerguide/using-attributes-for-access-control-policy-example.html

Intermittent "InvalidIdentityPoolConfigurationException" Error for Few Requests in AWS Identity Pool

Relevant content