amazon-web-services - AWS 认知 IAM : InvalidSmsRoleTrustRelationshipException: Role does not have a trust relationship allowing Cognito to assume the role

Question

我正在尝试使用 Go lang 通过 lambda 函数创建一个 Cognito 用户池。

IAM 角色、IAM 策略和信任关系策略已成功创建。

但是当我尝试创建 Cognito 池时，出现错误，

InvalidSmsRoleTrustRelationshipException:角色没有允许 Cognito 承担角色的信任关系。

信任关系策略是

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "cognito-idp.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

创建用户池 API 调用如下 -

newUserPoolData := &cognitoidentityprovider.CreateUserPoolInput{
        PoolName:               aws.String(poolName),
        Policies:               &userPoolPolicyType,
        AutoVerifiedAttributes: autoVerifiedAttributes,
        UsernameAttributes:     userNameAttributes,
        SmsConfiguration:       &smsConfingType,
    }

我是不是漏掉了什么？

Answer 1

服务角色策略应该有 service-role 路径。例如，arn 的格式应为 arn:aws:iam::{ACCOUNT_ID}:role/service-role/{role_name}

信任关系应该是:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "cognito-idp.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "{External ID}"
        }
      }
    }
  ]
}

角色的内联策略应该是

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sns:publish"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}