Cognito User Pool: Configuring Custom Email Sender

[mthenn]

I am trying to add a custom email sender to a Cognito UserPool via CDK but I seem to fail in setting up the permissions properly.

My code looks basically like this:

 // Setup kms key for email sender
 const customSenderKey = new Key(this, 'CognitoEmailSendKey');
 
 const emailSenderTriggerHandler = < create Lambda function >;

 const userPool = new UserPool(this, `UserPool`, {
    lambdaTriggers: {
      customEmailSender: emailSenderTriggerHandler,
      < ... other Triggers >,
    },
    customSenderKmsKey: customSenderKey,
  });

 // Give Cognito CrateGrant permission
  customSenderKey.addToResourcePolicy(
    new PolicyStatement({
      effect: Effect.ALLOW,
      principals: [new ServicePrincipal('cognito-idp.amazonaws.com')],
      actions: ['kms:CreateGrant', 'kms:Encrypt'],
      resources: ['*'],
    })
  );
  
// Give Lambda Decrypt permission
  senderKey.grantDecrypt(emailSenderTriggerHandler);
  
// Give Cognito Invoke permission
  emailSenderTriggerHandler.grantInvoke(new ServicePrincipal('cognito-idp.amazonaws.com'));

The cdk synth command runs without errors but during deployment I get the following message when creating the UserPool:

Caller needs to have kms:CreateGrant permission on provided KMS Key (Service: AWSCognitoIdentityProviderService; Status Code: 400; Error Code: NotAuthorizedException; Request ID: <request id>; Proxy: null)

I don't get the error since (at least in my understanding) I gave the permissions with the call to addToResourcePolicy, which generates the following KeyPolicy to the KMS key:

      {
       "Action": [
        "kms:CreateGrant",
        "kms:Encrypt"
       ],
       "Effect": "Allow",
       "Principal": {
        "Service": "cognito-idp.amazonaws.com"
       },
       "Resource": "*"
      }

Why is this not equivalent to the policy described in the documentation here?
Am I missing anything?

[mthenn]

Ok, I found the solution to my problem. I seem to have interpreted the error message wrong. The problem was that the IAM-Role executing Cloudformation did not have the permission kms:CreateGrant. After granting the permissions it seems to work as expected.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.