title: AWS: "Invalid identity pool configuration. Check assigned IAM roles for this pool." Error with AWS Lambda to query MYSQL db
body: <p>I'm using the Serverless Framework to deploy my Lambdas to CloudFormation, and the guide <a href="https://serverless-stack.com" rel="nofollow noreferrer">https://serverless-stack.com</a> to bootstrap my project.</p>
  
  <p>Upon running a test of my API, I get the following error in the console</p>
  
  <p>"Invalid identity pool configuration. Check assigned IAM roles for this pool."</p>
  
  <p>This question ( <a href="https://stackoverflow.com/questions/30425942/aws-cognito-invalid-identity-pool-configuration">AWS Cognito Invalid identity pool configuration</a> ) led me to check my Trust Relationships, and they are the same ID, so I've ruled out this as my problem.</p>
  
  <p>I've tried to ping this API using the following method:</p>
  
  <pre><code>$ npx aws-api-gateway-cli-test \
  --username='admin@example.com' \
  --password='Passw0rd!' \
  --user-pool-id='YOUR_COGNITO_USER_POOL_ID' \
  --app-client-id='YOUR_COGNITO_APP_CLIENT_ID' \
  --cognito-region='YOUR_COGNITO_REGION' \
  --identity-pool-id='YOUR_IDENTITY_POOL_ID' \
  --invoke-url='YOUR_API_GATEWAY_URL' \
  --api-gateway-region='YOUR_API_GATEWAY_REGION' \
  --path-template='/client' \
  --method='GET' 
  </code></pre>
  
  <p>and I get the same error.</p>
  
  <p>Also I should note that I can connect to this MYSQL instance in MYSQL Workbench without issues. </p>
  
  <p>This is my serverless.yml. </p>
  
  <p><strong>In the guide, they have the iamRoleStatements uncommented. I am unsure how to modify these for my MYSQL instance.</strong></p>
  
  <pre><code>
  service: myservice
  
  # Create an optimized package for our functions
  package:
    individually: true
  
  app: my-app
  
  provider:
    name: aws
    runtime: nodejs8.10
    region: us-east-2
    memorySize: 256
    timeout: 30
  
    # 'iamRoleStatements' defines the permission policy for the Lambda function.
    # In this case Lambda functions are granted with permissions to access DynamoDB.
   # iamRoleStatements:
   #   - Effect: Allow
   #     Action:
   #       - dynamodb:DescribeTable
   #       - dynamodb:Query
   #       - dynamodb:Scan
   #       - dynamodb:GetItem
   #       - dynamodb:PutItem
   #       - dynamodb:UpdateItem
   #      - dynamodb:DeleteItem
   #    Resource: "arn:aws:dynamodb:us-east-1:*:*"
  
    vpc:
      securityGroupIds:
        - SGID
      subnetIds:
        - subnet1
        - subnet2
        - subnet3
    environment:
      MYSQLHOST: 'HOST'
      MYSQLPORT: 'PORT'
      MYSQLUSER: 'USER'
      MYSQLPASS: 'PASS'
      MYSQLDATABASE: 'DATABSE'
  
  functions:  
    clientFunc:
      handler: client.handler
      events:
        - http:
            path: client
            method: get
            cors: true
            authorizer: aws_iam
        - http:
            path: client/{id}
            method: get
            cors: true
            authorizer: aws_iam
        - http:
            path: client
            method: post
            cors: true
            authorizer: aws_iam
        - http:
            path: client/{id}
            method: put
            cors: true
            authorizer: aws_iam
        - http:
            path: client/{id}
            method: delete
            cors: true
            authorizer: aws_iam
  
  plugins:
    - serverless-offline
  
    # Create our resources with separate CloudFormation templates
  resources: 
    - ${file(resources/api-gateway-errors.yml)}
  
  </code></pre>
  
  <p>I'm a beginner with AWS, any help would be appreciated, thanks.</p>
  
  <p>UPDATE:</p>
  
  <p>When I login with a user on my app, I get this response from a network call to AWS cognito</p>
  
  <pre><code>IdentityId: "us-east-2:t0cc2567-8d82-4ba4-9d06-065179256373"
  </code></pre>
  
  <p>My Authenticated role for my Identity pool has the following trust relationship, but the error still appears.</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Federated": "cognito-identity.amazonaws.com"
        },
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
          "StringEquals": {
            "cognito-identity.amazonaws.com:aud": "t0cc2567-8d82-4ba4-9d06-065179256373"
          },
          "ForAnyValue:StringLike": {
            "cognito-identity.amazonaws.com:amr": "unauthenticated"
          }
        }
      }
    ]
  }
  </code></pre>