Amazon Cognito InvalidSmsRoleAccessPolicyException

The IAM role for sending SMS messages does not have the correct permissions.

Understanding Amazon Cognito

Amazon Cognito is a robust authentication service provided by AWS that allows developers to add user sign-up, sign-in, and access control to their web and mobile applications quickly. It supports social identity providers like Facebook, Google, and Amazon, as well as enterprise identity providers via SAML 2.0 and OpenID Connect.

Identifying the Symptom

When using Amazon Cognito, you might encounter the InvalidSmsRoleAccessPolicyException. This error typically arises when there is an issue with the IAM role permissions related to sending SMS messages.

What You Observe

During the execution of your application, you may notice that SMS messages are not being sent as expected. The error message InvalidSmsRoleAccessPolicyException will be logged, indicating a permissions issue.

Explaining the Issue

The InvalidSmsRoleAccessPolicyException occurs when the IAM role associated with Amazon Cognito does not have the necessary permissions to send SMS messages. This is crucial for features like multi-factor authentication (MFA) where SMS is used to deliver verification codes.

Root Cause

The root cause of this issue is typically an incomplete or incorrect IAM policy attached to the role responsible for sending SMS messages. This role must have permissions to use the sns:Publish action.

Steps to Resolve the Issue

To resolve the InvalidSmsRoleAccessPolicyException, follow these steps:

Step 1: Identify the IAM Role

First, identify the IAM role that is being used by Amazon Cognito for sending SMS messages. This can usually be found in the AWS Cognito console under the settings for your user pool.

Step 2: Update the IAM Policy

Navigate to the IAM console and locate the identified role. Edit the policy attached to this role to include the necessary permissions. Ensure the policy includes the following:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sns:Publish",
"Resource": "*"
}
]
}

This policy grants the role permission to publish messages to SNS, which is required for sending SMS.

Step 3: Test the Configuration

After updating the policy, test your application to ensure that SMS messages are now being sent successfully. Monitor the logs to confirm that the InvalidSmsRoleAccessPolicyException no longer appears.

Additional Resources

For more information on configuring IAM roles and policies, refer to the AWS IAM User Guide. For detailed guidance on Amazon Cognito, visit the Amazon Cognito Developer Guide.

Try DrDroid: AI Agent for Debugging

80+ monitoring tool integrations
Long term memory about your stack
Locally run Mac App available

Thank you for your submission

We have sent the cheatsheet on your email!
Oops! Something went wrong while submitting the form.
Read more
Time to stop copy pasting your errors onto Google!

Try DrDroid: AI for Debugging

80+ monitoring tool integrations
Long term memory about your stack
Locally run Mac App available

Thankyou for your submission

We have sent the cheatsheet on your email!
Oops! Something went wrong while submitting the form.

Thank you for your submission

We have sent the cheatsheet on your email!
Oops! Something went wrong while submitting the form.
Read more
Time to stop copy pasting your errors onto Google!

MORE ISSUES

Deep Sea Tech Inc. — Made with ❤️ in Bangalore & San Francisco 🏢

Doctor Droid