I have javascript client to perform aws cognito authenticated login with provider (Facebook, Google, Twitter, etc). I can see it has been successful to get the Credential from :
var cognitoParam = {
'IdentityPoolId': 'ap-northeast-1:c8250ce6-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
'RoleArn': 'arn:aws:iam::xxxxxxxxxxxx:role/roleName'
'Logins': {
'accounts.google.com': response.detail.id_token
}
};
var cognitoCred = new AWS.CognitoIdentityCredentials(cognitoParam);
It returns all credentials object. And I checked also on AWS console, the pool ID has been listed/recorded in the federated identities pool as authenticated login with provider.
After get credential, I want to work with Cognito Sync Manager to store several user Info to cloud :
var syncManager = new AWS.CognitoSyncManager();
syncManager.openOrCreateDataset('profileSet', function(err, dataset) {
// dataset.get
// dataset.put
// dataset.remove
});
All methods (get, put, remove) work well, but I have an issue to run method synchronize. In example, after put new dataset :
dataset.put("keyTes", "english", function(err,record){
if(!err){
dataset.synchronize({
onSuccess: function(dataset, newRecords) {
console.log(newRecords);
},
onFailure: function(err) {
console.log("Error while synchronizing data to the cloud: " + err);
}
});
}
});
It shows error :
Error while synchronizing data to the cloud: AccessDeniedException: User: arn:aws:sts::xxxxxxxxxxxx:assumed-role/roleName/web-identity is not authorized to perform: cognito-sync:ListRecords on resource: arn:aws:cognito-sync:ap-northeast-1:xxxxxxxxxxxx:identitypool/ap-northeast-1:c8250ce6-xxxx-xxxx-xxxx-xxxxxxxxxxxx/identity/ap-northeast-1:653aeca2-xxxx-xxxx-xxxx-xxxxxxxxxxxx/dataset/profileSet
In the my IAM role, I set to :
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "cognito-identity.amazonaws.com"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"cognito-identity.amazonaws.com:aud": "default"
},
"ForAnyValue:StringLike": {
"cognito-identity.amazonaws.com:amr": "authenticated"
}
}
}
]
}
and the policy :
{ "Version": "2012-10-17", "Statement": [ { "Action": "cognito-sync:", "Effect": "Allow", "Resource": "" } ] }
I follow the reference from the link :
Amazon Cognito Sync Manager for JavaScript
Anyone can help me, please?