title: Defining IAM Roles for Identity Pool with CloudFormation to access s3 bucket
body: <p>I'm trying to define authorized/unauthorized roles for Identity Pool connected to User Pool with Cloud Formation. I'm using these instructions: <a href="https://docs.amplify.aws/lib/storage/getting-started/q/platform/js#using-amazon-s3" rel="nofollow noreferrer">https://docs.amplify.aws/lib/storage/getting-started/q/platform/js#using-amazon-s3</a></p>
  
  <p>But so far I have not succeeded with it. When UI calls Amplify.configure with the identity pool id, I get "Invalid identity pool configuration. Check assigned IAM roles for this pool."</p>
  
  <p>This is what I have: </p>
  
  <pre><code>  MyCognitoUserPool:
      Type: AWS::Cognito::UserPool
      Properties:
        ...
  
    MyCognitoUserPoolClient:
      Type: AWS::Cognito::UserPoolClient
      Properties:
        UserPoolId: !Ref MyCognitoUserPool
        GenerateSecret: false
  
    MyIdentityPool:
      Type: AWS::Cognito::IdentityPool
      Properties: 
        CognitoIdentityProviders: 
          - ClientId: !Ref MyCognitoUserPoolClient
            ProviderName: !GetAtt MyCognitoUserPool.ProviderName      
  
    MyIdentityPoolAuthRole: 
      Type: AWS::IAM::Role
      Properties: 
        AssumeRolePolicyDocument: 
          Version: '2012-10-17'
          Statement:                   
            - Effect: Allow
              Principal: 
                Federated:
                  - cognito-identity.amazonaws.com                   
              Action: 
                - sts:AssumeRole
              Condition:
                StringEquals:
                  cognito-identity.amazonaws.com:aud:
                    - !ImportValue mydevDocumentBucketArn
                ForAnyValue:StringLike:
                  cognito-identity.amazonaws.com:amr:
                    - authenticated
        Policies:              
          - PolicyName: identity-pool-auth-cognito-policy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement: 
                - Effect: Allow 
                  Action: 
                    - cognito-identity:*
                    - cognito-sync:*
                  Resource: '*'     
          - PolicyName: identity-pool-auth-public-policy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement: 
                - Effect: Allow 
                  Action: 
                    - s3:DeleteObject
                    - s3:GetObject
                    - s3:PutObject
                  Resource: 
                    - Fn::Sub:
                      - '${documentBucket}/public/*'
                      - documentBucket: !ImportValue mydevDocumentBucketArn
                    - Fn::Sub:
                      - '${documentBucket}/protected/${identitySub}/*'
                      - documentBucket: !ImportValue mydevDocumentBucketArn
                        identitySub: ${cognito-identity.amazonaws.com:sub}
                    - Fn::Sub:
                      - '${documentBucket}/private/${identitySub}/*'
                      - documentBucket: !ImportValue mydevDocumentBucketArn
                        identitySub: ${cognito-identity.amazonaws.com:sub}
          - PolicyName: identity-pool-auth-uploads-policy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement: 
                - Effect: Allow 
                  Action: 
                    - s3:PutObject
                  Resource: 
                    - Fn::Sub:
                      - '${documentBucket}/uploads/*'
                      - documentBucket: !ImportValue mydevDocumentBucketArn
          - PolicyName: identity-pool-auth-protected-policy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement: 
                - Effect: Allow 
                  Action: 
                    - s3:GetObject
                  Resource: 
                    - Fn::Sub:
                      - '${documentBucket}/protected/*'
                      - documentBucket: !ImportValue mydevDocumentBucketArn
          - PolicyName: identity-pool-auth-list-policy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement: 
                - Effect: Allow 
                  Action: 
                    - s3:ListBucket
                  Resource: !ImportValue mydevDocumentBucketArn
                  Condition: 
                    StringLike:
                        s3:prefix: 
                          - 'public/'
                          - 'public/*'
                          - 'protected/'
                          - 'protected/*'
                          - 'private/${cognito-identity.amazonaws.com:sub}/'
                          - 'private/${cognito-identity.amazonaws.com:sub}/*'
  
    MyIdentityPoolUnAuthRole:
      Type: AWS::IAM::Role
      Properties: 
        AssumeRolePolicyDocument: 
          Version: '2012-10-17'
          Statement:                
            - Effect: Allow
              Principal: 
                Federated:
                  - cognito-identity.amazonaws.com               
              Action: 
                - sts:AssumeRole
              Condition:
                StringEquals:
                  cognito-identity.amazonaws.com:aud:
                    - !ImportValue mydevDocumentBucketArn
                ForAnyValue:StringLike:
                  cognito-identity.amazonaws.com:amr:
                    - unauthenticated
        Policies:              
          - PolicyName: identity-pool-unauth-sync-policy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement: 
                - Effect: Allow 
                  Action: 
                    - cognito-sync:*
                  Resource: '*'  
          - PolicyName: identity-pool-unauth-public-policy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement: 
                - Effect: Allow 
                  Action: 
                    - s3:GetObject
                    - s3:PutObject
                    - s3:DeleteObject
                  Resource: 
                    - Fn::Sub:
                      - '${documentBucket}/public/*'
                      - documentBucket: !ImportValue mydevDocumentBucketArn
          - PolicyName: identity-pool-unauth-uploads-policy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement: 
                - Effect: Allow 
                  Action: 
                    - s3:PutObject
                  Resource: 
                    - Fn::Sub:
                      - '${documentBucket}/uploads/*'
                      - documentBucket: !ImportValue mydevDocumentBucketArn
          - PolicyName: identity-pool-unauth-protected-policy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement: 
                - Effect: Allow 
                  Action: 
                    - s3:GetObject
                  Resource: 
                    - Fn::Sub:
                      - '${documentBucket}/protected/*'
                      - documentBucket: !ImportValue mydevDocumentBucketArn
          - PolicyName: identity-pool-unauth-list-policy
            PolicyDocument: 
              Version: '2012-10-17'
              Statement: 
                - Effect: Allow 
                  Action: 
                    - s3:ListBucket
                  Resource: 
                    - Fn::Sub:
                      - '${documentBucket}/*'
                      - documentBucket: !ImportValue mydevDocumentBucketArn
                  Condition:
                    StringLike:
                      s3:prefix:
                          - 'public/'
                          - 'public/*'
                          - 'protected/'
                          - 'protected/*'
  
    MyIdentityPoolRoleAtt:
      Type: AWS::Cognito::IdentityPoolRoleAttachment
      Properties: 
        IdentityPoolId: !Ref MyIdentityPool
        Roles: 
          "authenticated": !GetAtt MyIdentityPoolAuthRole.Arn
          "unauthenticated": !GetAtt MyIdentityPoolUnAuthRole.Arn
        ```
  </code></pre>