amplify-js: "Invalid identity pool configuration. Check assigned IAM roles for this pool."

Thanks @Amplifiyer

I can confirm it’s an issue with how Amplify.configure handles the aws-exports.js file. Hopefully we can get this issue resolved before long (I’m happy to help), will also save other people time if this is mentioned in the docs while a fix is being worked on.

I was able to workaround the issue by manually applying the properties from aws-exports.js to Amplify.configure:

Amplify.configure({
  Auth: {
    identityPoolId: aws_exports['aws_cognito_identity_pool_id'], //REQUIRED - Amazon Cognito Identity Pool ID
    region: aws_exports['aws_project_region'], // REQUIRED - Amazon Cognito Region
    userPoolId: aws_exports['aws_user_pools_id'], //OPTIONAL - Amazon Cognito User Pool ID
    userPoolWebClientId: aws_exports['aws_user_pools_web_client_id'] //OPTIONAL - Amazon Cognito Web Client ID
  },
  Storage: {
    AWSS3: {
      bucket: aws_exports['aws_user_files_s3_bucket'], //REQUIRED -  Amazon S3 bucket
      region: aws_exports['aws_user_files_s3_bucket_region'] //OPTIONAL -  Amazon service region
    }
  }
});

I ran into this error but it wasn’t to do with the authRole as listed above. Mine was because I had manually created a group on Cognito and then was using that group and its associated role with some users. I wanted to document what I did in case anyone gets to this point and isn’t able to solve the problem.

TL;DR: Don’t manually create groups and roles if you’re going to be using them for Amplify.

What I did to find out what the role that was causing the issue was to take the access_token that gets returned on the POST request to AWS. You can take this token and plug it into https://jwt.io/ which will decode it.

My issue was that any account where I was getting the above error included the following attributes in that JWT

"cognito:roles": [
    "arn:aws:iam::*ACCOUNT_ID*:role/*THE_ROLE*"
  ],
"cognito:preferred_role": "arn:aws:iam::*ACCOUNT_ID*:role/*THE_ROLE*",

If you are getting this issue, find these roles and verify that they have the conditions attached to them from @timoteialbu’s response: "Condition": { "StringEquals": { "cognito-identity.amazonaws.com:aud": "us-west-2:<COGNITO_IDENTITY_POOL_ID>" }, "ForAnyValue:StringLike": { "cognito-identity.amazonaws.com:amr": "authenticated" } }

My solution was to just manually delete the group I’d created along with the role associated with it and then recreate it via the Amplify CLI and then just move all the users who were in the original group into the new one. This way Amplify maintains it when it changes.

I found a way to solve my issue regarding the InvalidIdentityPoolConfigurationException: Invalid identity pool configuration. Check assigned IAM roles for this pool. error.

The solution was to look up the authRole that amplify-cli creates and add trust relationships. Here is what I edited it to:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "us-west-2:<COGNITO_IDENTITY_POOL_ID>"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "authenticated"
        }
      }
    }
  ]
}

Since this was working before June 2020 (which was the last time we successfully created a new env and had it working with no extra changes like this), what has changed since? I looked through the changelog but could not find anything.

Are we supposed to add trust relationships ourselves?

I just upgraded to the latest version of these packages:

"aws-amplify": "3.3.4"
"aws-amplify-react": "4.2.8"

and the issue persists.

I have the same issue and changing the export file does not solve it.