title: AmazonCognitoIdentityProviderException: User is not authorized to perform cognito-idp:DescribeUserPool on resource
body: <p>I am learning integrating AWS with an ASP .NET Core site. I am using AWS Cognito as a user store. I have created a sign-up form which actually acts as an interface to AWS Cognito. So far I have done the following steps:</p>
  <ol>
  <li><p>Created an User Pool in AWS Cognito.</p>
  </li>
  <li><p>Created an User in IAM service. Attached the existing policy   &quot;AmazonCognitoDeveloperAuthenticatedIdentities&quot; to this User.</p>
  </li>
  <li><p>Created a credentials file in Windows in the user profile directory. Set the aws_access_key_id and aws_secret_access_key in this file</p>
  </li>
  <li><p>In the appsettings.json file created an AWS section and set keys as below (I have hidden the User Pool Client Secret):</p>
  <pre><code>&quot;AWS&quot;: {
  
  &quot;Region&quot;: &quot;us-east-2&quot;,
  
  &quot;UserPoolClientId&quot;: &quot;44m80ksabq0knieeg81ina2npj&quot;,
  
  &quot;UserPoolClientSecret&quot;: XXXXXX,
  
  &quot;UserPoolId&quot;: &quot;us-east-2_115WHTcaH&quot;
   }
  </code></pre>
  </li>
  <li><p>I have imported the Amazon.AspNetCore.Identity.Cognito and Amazon.Extensions.CognitoAuthentication nuget packages. Using these packages, I have passed CognitoUser as the T parameter to the SignInManager and UserManager of ASP .NET Core Identity classes. Below is the entire code of the controller.</p>
  <pre><code>public class Accounts : Controller
  {
      SignInManager&lt;CognitoUser&gt; _signInManager;
      UserManager&lt;CognitoUser&gt; _userManager;
      CognitoUserPool _pool;
  
      public Accounts(SignInManager&lt;CognitoUser&gt; signInManager, UserManager&lt;CognitoUser&gt; 
        userManager, CognitoUserPool pool)
      {
          _signInManager = signInManager;
          _userManager = userManager;
          _pool = pool;
      }
  
  
      [HttpPost]
      public async Task&lt;IActionResult&gt; SignUp(SignupModel model)
      {
          if (ModelState.IsValid)
          {
              var user = _pool.GetUser(model.Email);
              if (user.Status != null)
              {
                  ModelState.AddModelError(&quot;UserExists&quot;, &quot;User with this email already exists&quot;);
                  return View(model);
              }
  
              user.Attributes.Add(CognitoAttribute.Name.AttributeName, model.Email);
              var createdUser = await _userManager.CreateAsync(user, model.Password);
              if (createdUser.Succeeded)
              {
                  RedirectToAction(&quot;Confirm&quot;);
              }
          }
          return View();
      }
  }
  </code></pre>
  </li>
  </ol>
  <p>When I execute this code, I get an error when trying to create an user (await _userManager.CreateAsync(user, model.Password)) as</p>
  <pre><code>AmazonCognitoIdentityProviderException: User: arn:aws:iam::777844316068:user/xxxx is not authorized to perform: cognito-idp:DescribeUserPool on resource: arn:aws:cognito-idp:us-east-2:777844316068:userpool/us-east-2_115WHTcaH
  </code></pre>
  <p>I know this has to do with the Policy at IAM but I am not able to figure out the exact setting I am missing. Can someone help ?</p>