title: AWS/Cognito/IAM Error with Unauth role
body: <p><em>This message was originally posted on the AWS Developer Forums, but it seems like the AWS crowd is on SO, so I'm duplicating it here.</em></p>
  
  <p>Hi there, I'm an absolute AWS beginner so I'll try to be as clear as possible.</p>
  
  <p>I'm trying to use the JS API to allow any user on my site to upload videos to S3 (this works well) and then convert the uploaded files to other formats (with Elastic Transcoder).</p>
  
  <p>I've set up:</p>
  
  <ul>
  <li>an input (not public) and an output (public) buckets on S3. The input receives the user-submitted videos, that part works :)</li>
  <li>an Elastic Transcoder pipeline (<code>video-converter-test-pipeline-01</code>)</li>
  <li>a federated identity on Cognito (<code>video_converter_test_02</code>)</li>
  <li>matching Auth and Unauth roles on IAM (<code>Cognito_video_converter_test_02Auth_Role</code> and <code>Cognito_video_converter_test_02Unauth_Role</code>)</li>
  </ul>
  
  <p>The pipeline has the following permission summary: "The following IAM roles have been granted access to this pipeline: arn:aws:iam::529773801731:role/Elastic_Transcoder_Default_Role"</p>
  
  <p><code>Cognito_video_converter_test_02Unauth_Role</code> has two attached policies:</p>
  
  <ul>
  <li><code>oneClick_Cognito_video_converter_test_02Unauth_Role_1522923667877</code></li>
  <li><code>video-converter-policy</code>, that I made myself.</li>
  </ul>
  
  <p>Here's its JSON representation:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": "elastictranscoder:CreateJob",
              "Resource": [
                  "arn:aws:elastictranscoder:*:*:pipeline/*",
                  "arn:aws:elastictranscoder:*:*:preset/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>Here's how I try to create a transcoding job using the JS API:</p>
  
  <pre><code>function createJob(uploadedFileKey) {
      console.log("Create job", uploadedFileKey);
      var params = {
          PipelineId: PipelineId,
          Input: {
              Key: uploadedFileKey
          },
          Output: {
              PresetId: PresetId
          }
      };
      elastictranscoder.createJob(params, function (err, data) {
          if (err) console.error(err, err.stack); // an error occurred
          else console.log(data);           // successful response
      });
  }
  </code></pre>
  
  <p>When executing it, I get the following error:</p>
  
  <blockquote>
    <p>Error: User: arn:aws:sts::529773801731:assumed-role/Cognito_video_converter_test_02Unauth_Role/CognitoIdentityCredentials is not authorized to perform: elastictranscoder:CreateJob on resource: arn:aws:elastictranscoder:eu-west-1:529773801731:pipeline/1522763370759-mmowmr</p>
  </blockquote>
  
  <p>I tried using IAM Policy Simulator to understand what was wrong, but when doing so with the same parameters, I get "allowed"...</p>
  
  <p>I'm sure I'm doing something wrong here, but can't understand what. I've tried many things but nothing worked. Any help would be appreciated :)</p>
  
  <p>Thanks in advance, bye!</p>