Access Denied Exception AWS Lambda. AdminGetUser

Question

Getting an access denied with error message `
```
User: arn:aws:sts::************:assumed-role/UpdateLeaderboard-role-********/UpdateLeaderboard is not authorized to perform: cognito-idp:AdminGetUser on resource: arn:aws:cognito-idp:eu-west-2:************:userpool/arn:aws:cognito-idp:eu-west-2:************:userpool/eu-west-2_********* because no identity-based policy allows the cognito-idp:AdminGetUser action"
```
`

My policy is setup correctly:

```
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "VisualEditor0",
                "Effect": "Allow",
                "Action": [
                    "dynamodb:PutItem",
                    "dynamodb:DeleteItem",
                    "dynamodb:GetItem",
                    "dynamodb:Scan",
                    "cognito-idp:AdminGetUser"
                ],
                "Resource": [
                    "arn:aws:dynamodb:eu-west-2:************:table/Players",
                    "arn:aws:dynamodb:eu-west-2:************:table/Leaderboard",
                    "arn:aws:cognito-idp:eu-west-2:************:userpool/eu-west-2_*********"
                ]
            }
        ]
    }
```
It's already been days so the role has updated by now. The policy simulator for my role says denied as well.

Riku_Kobayashi · Accepted Answer

Hello.

Is it possible for you to share the Lambda code?  
As far as I can see in the error message, the ARN format is strange, so I think that the method of specifying the user pool ID is probably incorrect.  
```
# Incorrect ARN
arn:aws:cognito-idp:eu-west-2:************:userpool/arn:aws:cognito-idp:eu-west-2:************:userpool/eu-west-2_*********

# Correct ARN
arn:aws:cognito-idp:eu-west-2:************:userpool/eu-west-2_*********
```

I tried the code below on my AWS account and it ran successfully.  
Please make sure to include only the ID part, not the ARN, in "UserPoolId" as shown below.  
```
import boto3
import botocore

def lambda_handler(event, context):

client = boto3.client('cognito-idp')
    response = client.admin_get_user(
        UserPoolId='ap-northeast-1_yyyyyy',
        Username='11111111-1111-1111-1111-111111111111'
    )
    print(response)
```

Access Denied Exception AWS Lambda. AdminGetUser

Add your answer

Relevant content