action geo:GetPlace not recognizable for IAM policy

@jularbs I successfully called GetPlace using an unauthenticated Cognito pool. I tried the steps you've mentioned with the following IAM policy. Please let me know if it works for you.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PlacesReadOnly",
            "Effect": "Allow",
            "Action": [
                "geo:SearchPlaceIndex*",
                "geo:GetPlace"
            ],
            "Resource": "arn:aws:geo:us-east-1:************:place-index/*"
        }
    ]
}

Here's the (greatly simplified) code I'm using to call GetPlace:

const AWS = require('aws-sdk')
AWS.config.update({ region: 'us-east-1' })

const credentials = new AWS.CognitoIdentityCredentials({
  IdentityPoolId: 'us-east-1:********-****-****-****-************'
})

const location = new AWS.Location({
  credentials,
  region: AWS.config.region || 'us-east-1'
})

async function main () {
  const suggestions = await location.searchPlaceIndexForSuggestions({ IndexName: /*name*/, Text: /*text*/ }).promise()
  const placeID = suggestions.Results[0].PlaceId
  const place = await location.getPlace({ IndexName: /*name*/, PlaceId: placeID }).promise()
  console.log(place)
}

main()

Error

Having a look at the error:

"AccessDeniedException: User: arn:aws:sts::58*******976:assumed-role/Cognito_*************Management_***/CognitoIdentityCredentials is not authorized to perform: geo:GetPlace on resource: arn:aws:geo:ap-southeast-1:58*****65976:*",

it looks like the role associated with Cognito identity pool doesn't have the permission to perform the action or doesn't adhere with the condition mentioned in the permission policy associated.

Replication

Using the below permission policy, I was able to get place ID details :

CLI: aws location get-place --index-name explore.place --place-id AQAAAIw...QWQ

IAM Policy used:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "geo:GetPlace"
            ],
            "Resource": "arn:aws:geo:*:0123456789:place-index/*",
            "Condition": {
                "StringLikeIfExists": {
                    "aws:Referer": "http://localhost:*/*"
                }
            }
        }
    ]
}

Summary

In regard to your issue, it would require some troubleshooting in order to isolate the issue here. There can be multiple avenues to look at the issue:

• Is condition criteria met ?
• Is there any SCP restricting the action ?
• Check error logs to verify the error

That been said, I can see that you have associated a global condition "aws:Referer", so kindly make sure that referrer in the request sent indeed have referrer as included in the IAM policy. The aws:referer request context value is provided by the caller in an HTTP header. The Referer header is included in a web browser request when you select a link on a web page. Please note that when you perform the action by typing the URL into your browser, aws:referer is not present. When you invoke the API directly, aws:referer is also not present.

Having said that, I would recommend using the permission policy shared above and see if it works for you. You may also try to remove the condition and try to isolate the issue. If it still doesn't work for you, I would recommend reaching out to our "Amazon Location service" team through a support case to further troubleshoot, as it would require some tests to be performed in order to narrow down the issue here.

Thank you.

Just an FYI, GetPlace didnt work with via Cognito with an IAM policy indicated above, but using AWS Access Key and Secret Key for credentials worked for me. I just set my aws config with:

AWS.config.credentials = { accessKeyId: process.env.AWS_ACCESS_KEY_ID, secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY, };

Then i create location object as usual

const location = new AWS.Location({ region: AWS.config.region, });

But i still use my cognito identity pool for my map initialize.