# AWS Serverless IdentityPoolRoleAttachment

**URL:** <https://forum.serverless.com/t/aws-serverless-identitypoolroleattachment/4709>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [June 8, 2018, 3:35pm UTC](https://forum.serverless.com/t/aws-serverless-identitypoolroleattachment/4709 "2018-06-08T15:35:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MustSeeMelons](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mustseemelons/32/2062_2.png) [@MustSeeMelons](https://forum.serverless.com/u/MustSeeMelons)\
**Post date:** [June 8, 2018, 3:35pm UTC](https://forum.serverless.com/t/aws-serverless-identitypoolroleattachment/4709/1 "2018-06-08T15:35:28Z")

</div>

So, I’m creating a role for my Cognito users to be able to call API Gateway:

```
IdentityAuthenticatedRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Federated: "cognito-identity.amazonaws.com"
              Action:
                - "sts:AssumeRoleWithWebIdentity"
              Condition:
                StringEquals: 
                  "cognito-identity.amazonaws.com:aud":
                    - Ref: CognitoIdentityPoolStandardUserIdentityPool
                ForAnyValue:StringLike:
                  "cognito-identity.amazonaws.com:amr": authenticated
        Policies:
          - PolicyName: CognitoGatewayExecute
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - "execute-api:Invoke"
                  Resource: "arn:aws:execute-api:*:*:*"
        MaxSessionDuration: 3600

```

Then I’m attaching the role to my IdentityPoolRoleAttachment:

```
CognitoIdentityPoolRoleAttachment:
  DependsOn: CognitoIdentityPoolStandardUserIdentityPool
  Type: AWS::Cognito::IdentityPoolRoleAttachment
  Properties:
    IdentityPoolId:
      Fn::Join:
        - ''
        - - Ref: CognitoIdentityPoolStandardUserIdentityPool
          - ''
    Roles:
      authenticated:
        Fn:GetAtt
          - IdentityAuthenticatedRole
          - Arn

```

According to the docs it should work, but it of course does not:

`CognitoIdentityPoolRoleAttachment - Access to Role 'Fn:GetAtt - IdentityAuthenticatedRole - Arn' is forbidden.`

Can someone please shed some light on this?

P.S. As I’ve already pasted this snippet, there is one more thing: I’m using Fn::Join, because otherwise I’m greeted with “Is not of type String” error, is there a better way to handle it?

---

<div class="post-metadata">

**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\
**Post date:** [June 10, 2018, 12:13pm UTC](https://forum.serverless.com/t/aws-serverless-identitypoolroleattachment/4709/2 "2018-06-10T12:13:15Z")

</div>

I think the syntax is supposed to be:

```auto
CognitoIdentityPoolRoleAttachment:
  DependsOn: CognitoIdentityPoolStandardUserIdentityPool
  Type: AWS::Cognito::IdentityPoolRoleAttachment
  Properties:
    IdentityPoolId:
      Ref: CognitoIdentityPoolStandardUserIdentityPool
    Roles:
      authenticated:
        "Fn::GetAtt": [IdentityAuthenticatedRole, Arn]

```

I tend to prefer an alternative syntax so if that fails please try:

```auto
  Properties:
    IdentityPoolId: { "Ref": "CognitoIdentityPoolStandardUserIdentityPool" }
    Roles:
      authenticated: { "Fn::GetAtt": ["IdentityAuthenticatedRole", "Arn"] }

```

---

<div class="post-metadata">

**Author:** ![MustSeeMelons](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mustseemelons/32/2062_2.png) [@MustSeeMelons](https://forum.serverless.com/u/MustSeeMelons)\
**Post date:** [June 11, 2018, 8:25am UTC](https://forum.serverless.com/t/aws-serverless-identitypoolroleattachment/4709/3 "2018-06-11T08:25:02Z")

</div>

You were right, my syntax was simply wrong, thanks! Somehow could not see it.