title: Why is my AWS assumed role not authorised to perform cognito-idp:AdminGetUser?
body: <p>My Laravel application calls the <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUser.html" rel="nofollow noreferrer">AdminGetUser</a> endpoint.</p>
  <p>In the local environment, it successfully returns the resource.</p>
  <p>After deploying to a Vapor environment, it fails with the following error message:</p>
  <pre><code>User: arn:aws:sts::xxxx:assumed-role/laravel-vapor-role/xxxx is not authorized to perform: **cognito-idp:AdminGetUser** on resource: arn:aws:cognito-idp:us-east-1:xxxx:userpool/us-east-1_xxxx because no identity-based policy allows the cognito-idp:AdminGetUser action
  </code></pre>
  <p>What is the issue?</p>