title: AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity
body: <p>I've looked around similar problems, but couldn't resolve my problem. I'm developing an web application where the user will authenticate using AWS Cognito's authentication. The sign up part is ok, but when I try to sign in, I'm getting the "not authorized" exception. I've already tried to attach custom policies to my IAM Role (authorizing sts:AssumeRoleWithWebIdentity), but didn't work.. Here is how the code is written right now:</p>
  
  <pre><code>        var cognitoUser = new AWSCognito.CognitoIdentityServiceProvider.CognitoUser(userData);
  cognitoUser.authenticateUser(authenticationDetails, {
      onSuccess: function (result) {
          var sts = new AWS.STS({apiVersion: '2011-06-15'});
  
          var params = {
              RoleArn: 'arn:aws:iam::981601120657:role/Cognito_AliceAuth_Role', /* required */
              RoleSessionName: 'AliceUserSession', 
              WebIdentityToken: result.getIdToken().getJwtToken(), 
              Policy: '{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "sts:AssumeRoleWithWebIdentity", "Resource": "*" } ] }'
          };
  
          sts.assumeRoleWithWebIdentity(params, function (err, data) {
              if (err)
                  console.log(err, err.stack); // ** &lt;-- ERROR HERE
              else
                  console.log(data);           // successful response
          });
  
          //document.getElementById('authForm').submit();
      },
      onFailure: function (err) {
          alert(err);
      }
  
  });
  </code></pre>
  
  <p>As you can see, I specified the policy in the code too, but I still get the "AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity" error. Please help me :/</p>
  
  <p>EDIT:</p>
  
  <p>Inside the "Cognito_AliceAuth_Role" I've created the role policies:
  AssumeRoleWithWebIdentityPolicy:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
  <p>and: GetFederationTokenPolicy</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "sts:GetFederationToken",
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
  <p>The trust relationship:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Federated": "cognito-identity.amazonaws.com"
        },
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
          "StringEquals": {
            "cognito-identity.amazonaws.com:aud": "us-east-1:e4c1833d-a62b-402a-b995-1b2513b04c02"
          },
          "ForAnyValue:StringLike": {
            "cognito-identity.amazonaws.com:amr": "authenticated"
          }
        }
      }
    ]
  }
  </code></pre>