Insufficient permissions. CloudFront UpdateDistribution permission is required to create a custom domain.

While I am deploying the cloud formation template that contains the resources to create the custom domain for my Cognito user pool client present in the prod AWS account. This template is run using the aws code pipeline in the execute change step it fails due to this error Insufficient permissions. CloudFront UpdateDistribution permission is required to create a custom domain. why? But for the last deployment, it was a success, now it is showing these insufficient permissions issues.

主题

开发者工具管理与治理安全、身份和合规性

标签

AWS CodePipeline AWS CloudFormation Amazon Cognito AWS 证书管理器

语言

English

vallukoti

已提问 4 个月前205 查看次数

1 回答

最新
投票最多
评论最多

这些答案有用吗？为正确答案投票，以帮助社区从您的知识中受益。

Hello.

When you set up a custom domain for your Cognito user pool, your CloudFront distribution will be associated with it.
Therefore, I think that setting the following IAM policy will eliminate the error.
https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-add-custom-domain.html

{
    "Version": "2012-10-17",
    "Statement": [
         {
            "Sid": "AllowCloudFrontUpdateDistribution",
            "Effect": "Allow",
            "Action": [
                "cloudfront:updateDistribution"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

专家

Riku_Kobayashi

已回答 4 个月前

vallukoti
4 个月前
Means what you are saying is we need check whether the user running the ci/cd will have this policy if not need to add it to him right? If policy there means what should be the issue?
Riku_Kobayashi 专家
4 个月前

Means what you are saying is we need check whether the user running the ci/cd will have this policy if not need to add it to him right?

No, it is the CloudFormation service role that requires setting this policy. Since you are deploying CloudFormation with CodePipeline, you need to set an IAM policy for the CloudFormation service role. I think you set the CloudFormation service role when setting the CodePipeline deployment action, but you need to configure it for that service role.
vallukoti
4 个月前
Just now I checked the issue, is it possible to create the custom domain for the cognito user pool client manaully or not by giving the domain name and acm certificate it is not creating and showing an error like this, could you please help me?

one or more alias specified for the distribution includes an incorrectly configure DNS record that points to another cloud front distribution, You must update the DNS record to correct the problem.

Insufficient permissions. CloudFront UpdateDistribution permission is required to create a custom domain.

相关内容