Debug Your Infrastructure

Get Instant Solutions for Kubernetes, Databases, Docker and more

AWS CloudWatch
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Pod Stuck in CrashLoopBackOff
Database connection timeout
Docker Container won't Start
Kubernetes ingress not working
Redis connection refused
CI/CD pipeline failing

Amazon Cognito InvalidSmsRoleAccessPolicyException

The IAM role for sending SMS messages does not have the correct permissions.

Understanding Amazon Cognito

Amazon Cognito is a robust authentication service provided by AWS that allows developers to add user sign-up, sign-in, and access control to their web and mobile applications quickly. It supports social identity providers like Facebook, Google, and Amazon, as well as enterprise identity providers via SAML 2.0 and OpenID Connect.

Identifying the Symptom

When using Amazon Cognito, you might encounter the InvalidSmsRoleAccessPolicyException. This error typically arises when there is an issue with the IAM role permissions related to sending SMS messages.

What You Observe

During the execution of your application, you may notice that SMS messages are not being sent as expected. The error message InvalidSmsRoleAccessPolicyException will be logged, indicating a permissions issue.

Explaining the Issue

The InvalidSmsRoleAccessPolicyException occurs when the IAM role associated with Amazon Cognito does not have the necessary permissions to send SMS messages. This is crucial for features like multi-factor authentication (MFA) where SMS is used to deliver verification codes.

Root Cause

The root cause of this issue is typically an incomplete or incorrect IAM policy attached to the role responsible for sending SMS messages. This role must have permissions to use the sns:Publish action.

Steps to Resolve the Issue

To resolve the InvalidSmsRoleAccessPolicyException, follow these steps:

Step 1: Identify the IAM Role

First, identify the IAM role that is being used by Amazon Cognito for sending SMS messages. This can usually be found in the AWS Cognito console under the settings for your user pool.

Step 2: Update the IAM Policy

Navigate to the IAM console and locate the identified role. Edit the policy attached to this role to include the necessary permissions. Ensure the policy includes the following:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sns:Publish",
"Resource": "*"
}
]
}

This policy grants the role permission to publish messages to SNS, which is required for sending SMS.

Step 3: Test the Configuration

After updating the policy, test your application to ensure that SMS messages are now being sent successfully. Monitor the logs to confirm that the InvalidSmsRoleAccessPolicyException no longer appears.

Additional Resources

For more information on configuring IAM roles and policies, refer to the AWS IAM User Guide. For detailed guidance on Amazon Cognito, visit the Amazon Cognito Developer Guide.

Master 

Amazon Cognito InvalidSmsRoleAccessPolicyException

 debugging in Minutes

— Grab the Ultimate Cheatsheet

(Perfect for DevOps & SREs)

Most-used commands
Real-world configs/examples
Handy troubleshooting shortcuts
Your email is safe with us. No spam, ever.

Thankyou for your submission

We have sent the cheatsheet on your email!
Oops! Something went wrong while submitting the form.

🚀 Tired of Noisy Alerts?

Try Doctor Droid — your AI SRE that auto-triages alerts, debugs issues, and finds the root cause for you.

Heading

Your email is safe thing.

Thank you for your Signing Up

Oops! Something went wrong while submitting the form.

MORE ISSUES

Deep Sea Tech Inc. — Made with ❤️ in Bangalore & San Francisco 🏢

Doctor Droid