Some resources in CloudFormation for creating the Cognito SNS Role

CognitoSNSRole.yaml

  SNSRole:
    Type: AWS::IAM::Role
    Description: "An IAM Role to allow Cognito to send SNS messages"
    Properties:
      RoleName: !Sub ${APIName}-cognito-sns-role
      ManagedPolicyArns:
        - Ref: CognitoSNSPolicy
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - cognito-idp.amazonaws.com
    DependsOn:
      - CognitoSNSPolicy

  CognitoSNSPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Managed policy to allow Amazon Cognito to access SNS
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sns:publish
            Resource: "*"