title: Controlling access to AWS IoT policy actions for Cognito identities
body: <p><a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-controlling-access-to.html#policies-specifying-policy-arn]" rel="noreferrer">Documentation for IAM</a> state that the <code>Resource</code>-property for <code>AttachUserPolicy</code> and <code>DetacherUserPolicy</code> should be set to the user principal the managed policy will be attached to. While the documentation for <code>iot:AttachPrincipalPolicy</code> and <code>iot:DetachPrincipalPolicy</code> are not as detailed, the error message</p>
  
  <blockquote>
    <p>AccessDeniedException: User: arn:aws:sts::ACCOUNT_ID:assumed-role/ROLE/CognitoIdentityCredentials is not authorized to perform: iot:AttachPrincipalPolicy on resource: COGNITO_ID</p>
  </blockquote>
  
  <p>leads me to believe it expects an ARN for Cognito identity or identity pool. However, specifying ARNs shown in <a href="http://docs.aws.amazon.com/cognito/latest/developerguide/resource-permissions.html" rel="noreferrer">Cognito documentation</a> result in the same error. Cognito identity ARNs also fail validation in the policy generator.</p>
  
  <p>What resource should I specify so that <code>iot:AttachPrincipalPolicy</code> and <code>iot:DetachPrincipalPolicy</code> are permitted to attach/detach IoT policies on a Cognito identity?</p>