Support End User Messaging path for SMS Configuration in Cognito Userpool

Author: freyal4Created Sep 17, 2026Updated Sep 17, 2026
Labelsenhancementservice/iamneeds-triageservice/cognitoidp

Description

AWS Cognito now supports using End User Messaging to send messages while previously only supported SNS Direct for messaging.

Affected Resource(s) or Data Source(s)

  • aws_cognito_user_pool
  • aws_cognito_user_pool.sms_configuration

Potential Terraform Configuration

hcl

# note aws_iam_role, aws_iam_policy, and aws_iam_role_policy_attachment don't need any code changes, but they are required for the End User Messaging to work in cognito

resource "aws_iam_role" "cognito_sns_role" {

  name = var.cognito_sns_role_name
  path = "/service-role/"

  assume_role_policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Sid" : "",
        "Effect" : "Allow",
        "Principal" : {
          "Service" : "cognito-idp.amazonaws.com"
        },
        "Action" : "sts:AssumeRole",
        "Condition" : {
          "StringEquals" : {
            "sts:ExternalId" : "string_of_sms_external_id"
          }
        }
      }
    ]
  })
}

resource "aws_iam_policy" "cognito_sns_policy" {

  name = var.cognito_sns_publish_policy_name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["sms-voice:SendTextMessage"]
      Resource = aws_pinpointsmsvoicev2_pool.phone_resource.arn
    }]
  })
}

resource "aws_iam_role_policy_attachment" "cognito_sns_publish" {
  role       = aws_iam_role.cognito_sns_role.name
  policy_arn = aws_iam_policy.cognito_sns_policy.arn
}



resource "aws_cognito_user_pool" "example" {

  sms_configuration {
    eums_sms = {
      caller_arn = aws_iam_role.cognito_sns_role.arn,
      external_id = "string_of_sms_external_id",
      origination_identity = "arn of end-user-messaging-resource (phone number, phone pool, sender ID)",
      configuration_set_name = ..., 
      in_entity_id = ..., 
      region = ..., 
      in_template_id = ...,
      ... 
    }
  }
}

References

SMS configuration in Amazon Cognito user pools API, SMS Configuration Type documentation,

Cognito API operations that can set SMS settings: CreateUserPool, UpdateUserPool, SetUserPoolMFAConfig

Would you like to implement the enhancement?

No

Source: hashicorp/terraform-provider-aws