title: Setting up Lambda IAM Policy to access Cognito
body: <p>I've created a lambda to check for custom logic before signing up a new Cognito user. In creating the IAM Policy for this lambda, what is the correct &quot;Action&quot; and &quot;Resource&quot; I should use here?</p>
  <p>I'm following this guide: <a href="https://medium.com/@earlg3/using-lambda-aws-cognito-triggers-to-only-allow-auto-verification-to-specific-domain-db2efea79c44" rel="nofollow noreferrer">https://medium.com/@earlg3/using-lambda-aws-cognito-triggers-to-only-allow-auto-verification-to-specific-domain-db2efea79c44</a></p>
  <p>Lambda</p>
  <pre class="lang-js prettyprint-override"><code>exports.handler = function(event, context) {
      
      // Configure the email domain that will be allowed to automatically verify.
      var approvedDomain = &quot;approveddomain.com&quot;;
      
      // Log the event information for debugging purposes.
      console.log('Received event:', JSON.stringify(event, null, 2));if (event.request.userAttributes.email.includes('@' + approvedDomain)) {
          console.log (&quot;This is an approved email address. Proceeding to send verification email.&quot;);
          event.response.emailSubject = &quot;Signup Verification Code&quot;;
          event.response.emailMessage = &quot;Thank you for signing up. &quot; + event.request.codeParameter + &quot; is your verification code.&quot;;
          context.done(null, event);
      } else {
          console.log (&quot;This is not an approved email address. Throwing error.&quot;);
          var error = new Error('EMAIL_DOMAIN_ERR');
          context.done(error, event);
     }};
  </code></pre>
  <p>My best guess so far:</p>
  <pre><code>{
     &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;LambdaSignUp&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;cognito-sync:*&quot;,
                  &quot;cognito-idp:*&quot;,
              ],
              &quot;Resource&quot;: &quot;arn:aws:cognito-idp:REGION:ACCOUNT_ID:userpool/USER_POOL_ID&quot;
          }
      ]
  }
  </code></pre>