Support End User Messaging path for SMS Configuration in Cognito Userpool
Author: freyal4Created Sep 17, 2026Updated Sep 17, 2026
Labelsenhancementservice/iamneeds-triageservice/cognitoidp
Description
AWS Cognito now supports using End User Messaging to send messages while previously only supported SNS Direct for messaging.
Affected Resource(s) or Data Source(s)
aws_cognito_user_poolaws_cognito_user_pool.sms_configuration
Potential Terraform Configuration
# note aws_iam_role, aws_iam_policy, and aws_iam_role_policy_attachment don't need any code changes, but they are required for the End User Messaging to work in cognito
resource "aws_iam_role" "cognito_sns_role" {
name = var.cognito_sns_role_name
path = "/service-role/"
assume_role_policy = jsonencode({
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "",
"Effect" : "Allow",
"Principal" : {
"Service" : "cognito-idp.amazonaws.com"
},
"Action" : "sts:AssumeRole",
"Condition" : {
"StringEquals" : {
"sts:ExternalId" : "string_of_sms_external_id"
}
}
}
]
})
}
resource "aws_iam_policy" "cognito_sns_policy" {
name = var.cognito_sns_publish_policy_name
policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Action = ["sms-voice:SendTextMessage"]
Resource = aws_pinpointsmsvoicev2_pool.phone_resource.arn
}]
})
}
resource "aws_iam_role_policy_attachment" "cognito_sns_publish" {
role = aws_iam_role.cognito_sns_role.name
policy_arn = aws_iam_policy.cognito_sns_policy.arn
}
resource "aws_cognito_user_pool" "example" {
sms_configuration {
eums_sms = {
caller_arn = aws_iam_role.cognito_sns_role.arn,
external_id = "string_of_sms_external_id",
origination_identity = "arn of end-user-messaging-resource (phone number, phone pool, sender ID)",
configuration_set_name = ...,
in_entity_id = ...,
region = ...,
in_template_id = ...,
...
}
}
}
References
SMS configuration in Amazon Cognito user pools API, SMS Configuration Type documentation,
Cognito API operations that can set SMS settings: CreateUserPool, UpdateUserPool, SetUserPoolMFAConfig
Would you like to implement the enhancement?
No
Source: hashicorp/terraform-provider-aws