-1

An error occurred (NotAuthorizedException) when calling the UpdateUserPool operation: Caller needs to have kms:CreateGrant permission on provided KMS Key

aws cognito-idp update-user-pool --user-pool-id {user_pool_id} --lambda-config "CustomEmailSender={LambdaVersion=V1_0,LambdaArn= lambda-arn },KMSKeyID=key-arn"

docs

Ranjan Raj Shrestha
  • 89
  • 1
  • 6

1 Answers1

1

There is likely one of two issues going on:

  1. You have the default KMS Key policy applied to the key-arn KMS key, but have not assigned kms:CreateGrant permission to an IAM policy applied to the user/principal running that command.
  2. You have not applied kms:CreateGrant permission for the principal running the command in the KMS key policy for the key-arn KMS key.
Foghorn
  • 2,238
  • 2
  • 13
  • 35