title: What permissions are required to create Cognito User Pool with SMS MFA?
body: <p>I've attached &quot;AmazonCognitoPowerUser&quot; policy with permissions below:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;cognito-identity:*&quot;,
                  &quot;cognito-idp:*&quot;,
                  &quot;cognito-sync:*&quot;,
                  &quot;iam:ListRoles&quot;,
                  &quot;iam:ListOpenIdConnectProviders&quot;,
                  &quot;iam:GetRole&quot;,
                  &quot;iam:ListSAMLProviders&quot;,
                  &quot;iam:GetSAMLProvider&quot;,
                  &quot;kinesis:ListStreams&quot;,
                  &quot;lambda:GetPolicy&quot;,
                  &quot;lambda:ListFunctions&quot;,
                  &quot;sns:GetSMSSandboxAccountStatus&quot;,
                  &quot;sns:ListPlatformApplications&quot;,
                  &quot;ses:ListIdentities&quot;,
                  &quot;ses:GetIdentityVerificationAttributes&quot;,
                  &quot;mobiletargeting:GetApps&quot;,
                  &quot;acm:ListCertificates&quot;
              ],
              &quot;Resource&quot;: &quot;*&quot;
          },
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: &quot;iam:CreateServiceLinkedRole&quot;,
              &quot;Resource&quot;: &quot;*&quot;,
              &quot;Condition&quot;: {
                  &quot;StringEquals&quot;: {
                      &quot;iam:AWSServiceName&quot;: [
                          &quot;cognito-idp.amazonaws.com&quot;,
                          &quot;email.cognito-idp.amazonaws.com&quot;
                      ]
                  }
              }
          },
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;iam:DeleteServiceLinkedRole&quot;,
                  &quot;iam:GetServiceLinkedRoleDeletionStatus&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:iam::*:role/aws-service-role/cognito-idp.amazonaws.com/AWSServiceRoleForAmazonCognitoIdp*&quot;,
                  &quot;arn:aws:iam::*:role/aws-service-role/email.cognito-idp.amazonaws.com/AWSServiceRoleForAmazonCognitoIdpEmail*&quot;
              ]
          }
      ]
  }
  </code></pre>
  <p>User can create a User Pool with MRA Required if it's TOTP only. They cannot create it with SMS MFA, nor can they add SMS MFA afterwards. The error says doesn't have permission but I thought this policy should already allow users to manage Cognito. What permissions are we missing?</p>
  <p>I'm thinking it's because SMS MFA requires a Role but they're already able to &quot;Create Role&quot; during the step of the User Pool creation process. It's when they save the user pool that it fails.</p>