cognito-identity:GetCredentialsForIdentity is a Read access-level action in the cognito-identity service. Grants permission to return credentials for the provided identity ID
This action does not support resource-level permissions; use "Resource": "*" in your policy.
Keys you can use in the Condition block of a policy that grants cognito-identity:GetCredentialsForIdentity.
Filters access by the owning AWS account ID for identity pool authenticated users. Applies to unauthenticated (public) API operations
Filters access by the identity pool ID for a given authenticated-user identity ID. Applies to unauthenticated (public) API operations
Filters access by the owning AWS account ID of an identity pool for identity pool guest users. Applies to unauthenticated (public) API operations
Filters access by the identity pool ID for a given guest-user identity ID. Applies to unauthenticated (public) API operations
A minimal policy that allows cognito-identity:GetCredentialsForIdentity. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCognitoidentityGetCredentialsForIdentity",
"Effect": "Allow",
"Action": "cognito-identity:GetCredentialsForIdentity",
"Resource": "*"
}
]
}