Invalid identity pool configuration in AWSIoT - swift

Question

I want to connect to an my client's MQTT service on AWS. I found this Amazon IoT Sample, which saves me a lot of time to dig through the API to find the process of connecting an AWS MQTT service.
In my project, I changed constants in Constants.swift in order to access MQTT service of my client, as following:
let AWSRegion = AWSRegionType.USWest2 // e.g. AWSRegionType.USEast1
let CognitoIdentityPoolId = "us-west-2:e95087f0-48a7-4732-b482-4614c7c63db6"
let CertificateSigningRequestCommonName = "MyApp"
let CertificateSigningRequestCountryName = "MyCountry"
let CertificateSigningRequestOrganizationName = "MyOrganization"
let CertificateSigningRequestOrganizationalUnitName = "MyUnit"
let PolicyName = "pubsub_policy"
// This is the endpoint in your AWS IoT console. eg: https://xxxxxxxxxx.iot.<region>.amazonaws.com
let IOT_ENDPOINT = "https://<endpoint>.amazonaws.com" // endpoint is entered correctly!
let ASWIoTDataManager = "MyIotDataManager"
But when I press Connect, the app throws this error:
2018-06-04 17:12:59:992 IoTSampleSwift[4999:2464150] Response body:
{"__type":"InvalidIdentityPoolConfigurationException","message":"Invalid identity pool configuration. Check assigned IAM roles for this pool."}
2018-06-04 17:12:59:994 IoTSampleSwift[4999:2464150]
GetCredentialsForIdentity failed. Error is [Error
Domain=com.amazonaws.AWSCognitoIdentityErrorDomain Code=5 "(null)"
UserInfo={__type=InvalidIdentityPoolConfigurationException,
message=Invalid identity pool configuration. Check assigned IAM roles
for this pool.}]
2018-06-04 17:12:59:995 IoTSampleSwift[4999:2464150]
Unable to refresh. Error is [Error
Domain=com.amazonaws.AWSCognitoIdentityErrorDomain Code=5 "(null)"
UserInfo={__type=InvalidIdentityPoolConfigurationException,
message=Invalid identity pool configuration. Check assigned IAM roles
for this pool.}]
2018-06-04 17:13:00:017 IoTSampleSwift[4999:2464150]
error: Error Domain=com.amazonaws.AWSCognitoIdentityErrorDomain Code=5
"(null)" UserInfo={__type=InvalidIdentityPoolConfigurationException,
message=Invalid identity pool configuration. Check assigned IAM roles
for this pool.}
Is there something wrong with my parameters in Constants.swift?
Is there something to enable at my client's service so I can access?
According to 10): p12 file: if available, then I don't have to create keys and certificates dynamically every time I need to access this MQTT service? But my client has to create it on his Amazon AWS IoT Console and gives me the certificate/key so I can generate this p12 file on my MAC?
Sorry, I have to ask these simple questions since I'm new to AWS IoT API.
Regards,

Answer 1

It would help to know what type of IoT authentication you're using. If you're using Cognito for your AWS IoT authentication, then the below will definitely help.
In IAM console in AWS, go to Roles. Click on your role and view the trust relationships. It's easier to see where this tab is in the picture below.
There's a good chance that the value for your StringEquals condition does not match the value for your identity pool. You can view this in Cognito > Federated Identities > Click blue link with "Name of your identity pool here" > Edit identity pool (top right) and your identity pool ID is at the top. If this is the case, click "Edit trust relationship" (seen in the image below) and edit so that the value for the key "cognito-identit.amazonaws.com::aud" matches your identity pool ID.