User: anonymous is not authorized to perform: cognito-identity:GetId on resource: * with an explicit deny in a resource control policy"

[IT-Ga-Hanoi]

We applied RCPs to cognito as guide, but when we login to cognito to AWS connect , we get a errors as bellow. (note: after we login with user/pass is DONE)

{"__type":"AccessDeniedException","Message":"User: anonymous is not authorized to perform: cognito-identity:GetId on resource: * with an explicit deny in a resource control policy"}

[liwadman]

Sorry this happened to you!

Are you able to share the policy in this repo you applied, and tell us more about the scenario in which this occured?

[IT-Ga-Hanoi]

Sorry this happened to you!

Are you able to share the policy in this repo you applied, and tell us more about the scenario in which this occured?

i applied new resources for new RCPs support. JSON as below.

	{
		"Sid": "CTCOGNITOPV5",
		"Effect": "Deny",
		"Principal": "*",
		"Action": [
			"cognito-idp:*",
			"cognito-identity:*",
			"aoss:*",
			"logs:*",
			"dynamodb:*",
			"ecr:*"
		],
		"Resource": "*",
		"Condition": {
			"StringNotEqualsIfExists": {
				"aws:PrincipalOrgID": "o-3xxxxxxxxxxxxx"
			},
			"BoolIfExists": {
				"aws:PrincipalIsAWSService": "false"
			},
			"ArnNotLike": {
				"aws:PrincipalArn": [
					"arn:aws:iam::4444444444:role/*"
				]
			}
		}
	},

But, when i login to my AWS connect (authen + authoz) via cognito . i have been login successfully, but page can not load. and a check debug saw this errors :
{"__type":"AccessDeniedException","Message":"User: anonymous is not authorized to perform: cognito-identity:GetId on resource: * with an explicit deny in a resource control policy"}

[liwadman]

I would expect the policy you shared to cause that deny.

The reason indeed is that the cognito-identity actions "GetId" and "GetCredentialsForIdentity" are called by an anonymous principal. An anonymous principal is what is used in policy evaluation whenever a request is not made with AWS Sigv4 credentials such as those belonging to an IAM role or user.

Those calls are made with cognito credentials.

To avoid encountering this error I would advise removing the cognito-identity actions from your RCP that is restricting access to only principals belonging to your organization as cognito-identity actions will never be able to meet that criteria.