title: Unauthenticated access to AWS services using Cognito
body: <p>I am trying to write a simple JavaScript (running in browser), that will get information about my Beanstalk applications with describeApplications function. I've created Cognito Identity Pool with unauthenticated access checkbox set and attached AWSElasticBeanstalkReadOnlyAccess policy to the Role of Identity Pool. </p>
  
  <p>Here is the code:</p>
  
  <pre><code>&lt;script src="https://sdk.amazonaws.com/js/aws-sdk-2.134.0.min.js"&gt;&lt;/script&gt;
  &lt;script&gt;
      AWS.config.region = 'eu-west-1'; // Region
  
      AWS.config.credentials = new AWS.CognitoIdentityCredentials({
          IdentityPoolId: 'eu-west-1:....',
      });
  
      var elasticbeanstalk = new AWS.ElasticBeanstalk();
      elasticbeanstalk.describeApplications({}, function (err, data) {
          if (err) {
              console.log(err);
              console.log(err.stack);
          } else {
              console.log(data);
          }
      });
  </code></pre>
  
  <p></p>
  
  <p>Here is the output in console:</p>
  
  <pre><code>{ResponseMetadata: {…}, Applications: Array(0)}
  </code></pre>
  
  <p>Applications array is empty! But I definitely have applications in eu-west-1 region. </p>
  
  <p>To make a simple test I created a user, attached same policy and hard coded user credentials instead of CognitoIdentityCredentials: </p>
  
  <pre><code>&lt;script src="https://sdk.amazonaws.com/js/aws-sdk-2.134.0.min.js"&gt;&lt;/script&gt;
  &lt;script&gt;
      AWS.config.region = 'eu-west-1'; // Region
  
      AWS.config.accessKeyId = '...';
      AWS.config.secretAccessKey = '...';
  
      var elasticbeanstalk = new AWS.ElasticBeanstalk();
      elasticbeanstalk.describeApplications({}, function (err, data) {
          if (err) {
              console.log(err);
              console.log(err.stack);
          } else {
              console.log(data);
          }
      });
  </code></pre>
  
  <p></p>
  
  <p>And voila, I see my beanstalk applications: </p>
  
  <pre><code>{ResponseMetadata: {…}, Applications: Array(1)}
  </code></pre>
  
  <p>I have done other tests. I tried to list S3 buckets with unauth. access and Cognito - it also works. That means my unauth. role is properly attached and applied. But I have no idea, why I see no applications in beanstalk!</p>
  
  <p>What am I doing wrong with unauthenticated access and Cognito? Any help will be really appreciated!</p>
  
  <p><strong>Update!</strong></p>
  
  <p>Thanks Mike Patrick for pointing to the right direction! <a href="https://stackoverflow.com/a/46820122/1858818">https://stackoverflow.com/a/46820122/1858818</a></p>
  
  <p>I switched to basic authentication flow and that was it. Here is the working piece of code:</p>
  
  <pre><code>AWS.config = {
      apiVersions: { elasticbeanstalk: '2010-12-01' },
      region: 'eu-west-1',
      credentials: new AWS.WebIdentityCredentials({
          RoleArn: 'my role arn'
      })
  };            
  
  var cognitoidentity = new AWS.CognitoIdentity(),
      elasticbeanstalk = new AWS.ElasticBeanstalk();
  
  var params = {
      IdentityPoolId: 'my cognito identity pool id', /* required */
  };
  cognitoidentity.getId(params, function(err, data) {
      if (err){
          console.log(err, err.stack); // an error occurred
      } else {
          var params = {
              IdentityId: data.IdentityId
          };
          cognitoidentity.getOpenIdToken(params, function(err, data) {
              if (err) {
                  console.log(err, err.stack); // an error occurred
              } else {
  
                  AWS.config.credentials.params.WebIdentityToken = data.Token;
  
                  //here we go, elasticbeanstalk functions work as expected
  
              }
          });        
      }
  });
  </code></pre>