title: Not authorized to perform sts:AssumeRoleWithWebIdentity AWS s3 Cognito auth failure
body: <p>I have a simple iOS app that uploads to s3. I'm trying unauth all around- even though ideally I want to do Facebook. </p>
  
  <p>2 IAM Roles (created using the wizard). The IAM auth policy (for unauth role):</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [{
          "Action": [
              "mobileanalytics:PutEvents",
              "cognito-sync:*"
          ],
          "Effect": "Allow",
          "Resource": [
              "*"
          ]
        },
        {
        "Effect": "Allow",
        "Action": [
          "s3:PutObject",
          "s3:GetObject",
          "s3:DeleteObject"
        ],
        "Resource": "arn:aws:s3:::[mybucketname]/*"
      }
  
    ]
  }
  </code></pre>
  
  <p>My constants.h file (scrubbed):</p>
  
  <pre><code>#define AWSID @"[12 digit num]"
  #define PoolID @"us-east-1:[long id number]"
  #define CRUnauth @"arn:aws:iam::[id num]:role/Cognito_Auth_DefaultRole"
  #define CRAuth @"arn:aws:iam::[id num]:role/Cognito_auth_DefaultRole"
  </code></pre>
  
  <p>My appDelegate.m file has this:</p>
  
  <pre><code>credentialsProvider = [AWSCognitoCredentialsProvider credentialsWithRegionType:AWSRegionUSEast1 accountId:AWSID identityPoolId:PoolID unauthRoleArn:CRUnauth authRoleArn:nil];
  AWSServiceConfiguration *configuration = [AWSServiceConfiguration configurationWithRegion:AWSRegionSAEast1
                                                                        credentialsProvider:credentialsProvider];
  [AWSServiceManager defaultServiceManager].defaultServiceConfiguration = configuration;
  </code></pre>
  
  <p>I made credentialsProvider a property since I need to add the Facebook login at some point.</p>
  
  <p>I'm simply uploading a bundle image to test this. In my viewController:</p>
  
  <pre><code> if([app.fb_token length] &gt; 0){
          app.credentialsProvider.logins = @{ @(AWSCognitoLoginProviderKeyFacebook): app.fb_token };
      }
      AWSS3TransferManager *transferManager = [AWSS3TransferManager defaultS3TransferManager];
      UIImage *image = [UIImage imageNamed:@"yayDot"];
      NSArray *paths = NSSearchPathForDirectoriesInDomains(NSDocumentDirectory,
                                                           NSUserDomainMask, YES);
      NSString *documentsDirectory = [paths objectAtIndex:0];
      NSString* path = [documentsDirectory stringByAppendingPathComponent:
                        @"yayDot.png" ];
      NSData* data = UIImagePNGRepresentation(image);
      [data writeToFile:path atomically:YES];
  
      AWSS3TransferManagerUploadRequest *uploadRequest = [AWSS3TransferManagerUploadRequest new];
      uploadRequest.body = [NSURL URLWithString:path];
      uploadRequest.key = @"yayDot.png";
      uploadRequest.bucket = thebucket;
      [AWSLogger defaultLogger].logLevel = AWSLogLevelVerbose;
  
      [[transferManager upload:uploadRequest] continueWithBlock:^id(BFTask *task) {
          // Do something with the response
          NSLog(@"result: %@", task.result);
  
          return nil;
      }];
  </code></pre>
  
  <p>Full error:</p>
  
  <pre><code>AWSURLResponseSerialization.m line:258 | -[AWSXMLResponseSerializer responseObjectForResponse:originalRequest:currentRequest:data:error:] | Response header: [{
      "Content-Length" = 299;
      "Content-Type" = "text/xml";
      Date = "Tue, 27 Jan 2015 18:54:17 GMT";
      "x-amzn-RequestId" = "xxxxx";
  }]
  2015-01-27 10:54:18.052  AWSiOSSDKv2 [Verbose] AWSURLResponseSerialization.m line:263 | -[AWSXMLResponseSerializer responseObjectForResponse:originalRequest:currentRequest:data:error:] | Response body: [&lt;ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/"&gt;
    &lt;Error&gt;
      &lt;Type&gt;Sender&lt;/Type&gt;
      &lt;Code&gt;AccessDenied&lt;/Code&gt;
      &lt;Message&gt;Not authorized to perform sts:AssumeRoleWithWebIdentity&lt;/Message&gt;
    &lt;/Error&gt;
    &lt;RequestId&gt;xxxxx&lt;/RequestId&gt;
  &lt;/ErrorResponse&gt;
  ]
  2015-01-27 10:54:18.059 lookyloo[20024:332664] AWSiOSSDKv2 [Error] AWSCredentialsProvider.m line:587 | __40-[AWSCognitoCredentialsProvider refresh]_block_invoke356 | Unable to refresh. Error is [Error Domain=com.amazonaws.AWSSTSErrorDomain Code=0 "The operation couldn’t be completed. (com.amazonaws.AWSSTSErrorDomain error 0.)" UserInfo=0x7d936310 {Type=Sender, Message=Not authorized to perform sts:AssumeRoleWithWebIdentity, __text=(
      "\n    ",
      "\n    ",
      "\n    ",
      "\n  "
  ), Code=AccessDenied}]
  </code></pre>