User: arn:aws:sts::****:assumed-role/aws-lambda-execute/**** is not authorized to perform: cognito-idp:AdminInitiateAuth on resource: arn:aws:cognito

Thanks in advace for the help!

I am encountering an error when deploying my frontend nextjs code on vercel, whereas the same code is working correctly on my local machine.

I am using aws lambda and cognito service. lambda already deployed but and its work fine with nextjs local application but when i deploy nextjs app then its gives me the permission issue at the time of login.

AccessDeniedException: User: arn:aws:sts::672624023363:assumed-role/aws-lambda-execute/80a5c4b676c2fd90d3fee4d9b88ff4d1e8f99360429f3df3aa079adeffdecdf0 is not authorized to perform: cognito-idp:AdminInitiateAuth on resource: arn:aws:cognito-idp:us-east-2:6726240

The reason you are getting this issue on Vercel, and not on local is because AWS credentials seems to be missing on Vercel server.

On local machine, you might be having the aws credential profile configured and that profile might be having sufficient permissions to assume the required role.

Solution

1. Create an IAM user with sufficient permissions, and generate security credentials.

2. Add following AWS environment variables on your Vercel server where your application is running.

   AWS_ACCESS_KEY_ID=<your access key id>
   AWS_SECRET_ACCESS_KEY=<your access secret key>
   AWS_DEFAULT_REGION=<aws region>
   

   See Vercel docs here learn how to do this.

I also found another blog post explaining the same thing. You may read this as well - How can I use AWS SDK Environment Variables on Vercel?