title: How to add a user to a Cognito User Pool Group from AWS Lambda?
body: <p>I'm trying to add a user a to cognito user pool group from a lambda that gets triggered post confirmation. This is the code for that lambda:</p>
  <pre class="lang-js prettyprint-override"><code>    export async function postAuth(event, context, callback) {
        var AWS = require('aws-sdk');
        var cognitoidentityserviceprovider = new AWS.CognitoIdentityServiceProvider({apiVersion: '2016-04-18'});
    
        var params = {
          GroupName: process.env.S3_GROUP_NAME,
          UserPoolId: event.userPoolId,
          Username: event.userName
        };
  
        cognitoidentityserviceprovider.adminAddUserToGroup(params, function(err, data) {
          if (err) console.log(&quot;Error&quot;);
          else     console.log(&quot;Success&quot;);
        });
    
        console.log(&quot;Executed.&quot;);
  
        context.succeed(event);
  
      }
  </code></pre>
  <p>I know for a fact that this lambda gets triggered because the I can see &quot;executed&quot; gets logged on CloudWatch. However, the call to <code>adminAddUserToGroup</code> doesn't seem to go through at all as neither the error message nor the success message get logged.</p>
  <p>My reason for trying to do this is so that I can grant groups different roles to access backend resources. For instance I could have a group <code>Admin</code> with the role <code>CanWriteToS3</code> and a group <code>Customer</code> with the role <code>CanReadFromS3</code> and add or remove users from groups as needed.</p>
  <p>I suspect one of the issues with this lambda is that it lacks the correct permissions to add and remove users from a group.</p>
  <p>This is the role attached to the lambda:</p>
  <pre class="lang-yaml prettyprint-override"><code>    GroupManagementRole:
        Type: AWS::IAM::Role
        Properties:
          RoleName: GroupManagementRole
          AssumeRolePolicyDocument:
            Version: &quot;2012-10-17&quot;
            Statement:
              - Effect: &quot;Allow&quot;
                Principal:
                  Service: [lambda.amazonaws.com]
                Action: sts:AssumeRole
          Policies:
            - PolicyName: &quot;GroupManagementPolicy&quot;
              PolicyDocument:
                Version: &quot;2012-10-17&quot;
                Statement:
                  - Effect: Allow
                    Action:
                      - logs:CreateLogGroup
                      - logs:CreateLogStream
                      - logs:PutLogEvents
                    Resource: 
                      - 'Fn::Join':
                        - ':'
                        -
                          - 'arn:aws:logs'
                          - Ref: 'AWS::Region'
                          - Ref: 'AWS::AccountId'
                          - 'log-group:/aws/lambda/*:*:*'
                  - Effect: &quot;Allow&quot;
                    Action: [&quot;cognito-idp:AdminAddUserToGroup&quot;, &quot;cognito-idp:AdminRemoveUserFromGroup&quot;]
                    Resource:
                      Fn::Join:
                         - &quot;&quot;
                         - - &quot;arn:aws:cognito-idp:us-east-1:XXXXXXXXXXX:userpool/us-east-1_XXXXXXX/*&quot;
  </code></pre>
  <p>I'm not sure whether I should be using the cognito user pool's arn for the resource but I've searched online and I cannot find any documentation on cognito user pool groups ARNs.</p>
  <p>Whatever the problem is, I can't diagnose it since my call to <code>adminAddUserToGroup</code> doesn't seem to go through at all.</p>