cognito、phpからadminInitiateAuthを使うとAccessDeniedException

Fatal error: Uncaught exception 'Aws\CognitoIdentityProvider\Exception\CognitoIdentityProviderException' with message 'Error executing "AdminInitiateAuth" on "https://cognito-idp.ap-northeast-1.amazonaws.com"; AWS HTTP error: Client error: `POST https://cognito-idp.ap-northeast-1.amazonaws.com` resulted in a `400 Bad Request` response: {"__type":"AccessDeniedException","Message":"User: arn:aws:iam::xxxxxx:user/xxxxxxxxx is not authorized to pe (truncated...) AccessDeniedException (client): User: arn:aws:iam::xxxxxxxx:user/xxxxxxxx is not authorized to perform: cognito-idp:AdminInitiateAuth on resource: arn:aws:cognito-idp:ap-northeast-1:xxxxxxxx:userpool/ap-northeast-xxxxxxx - {"__type":"AccessDeniedException","Message":"User: arn:aws:iam::xxxxxxx:user/xxxxxxx is not authorized to perform: cognito-idp:AdminInitiateAuth on resource: arn:aws:cognito-idp:ap-northeast-1:xxxxxxx:userpool/ap-northeast-xxxxxxx"}' exception 'GuzzleHttp\Exception\ClientException' with message 'Cl in /Library/WebServer/Documents/bmj/aws_sdk/Aws/WrappedHttpHandler.php on line 192

というエラーが…。これは、該当するユーザーのIAMで、

AmazonCognitoDeveloperAuthenticatedIdentities

AmazonCognitoPowerUser

の2つをアタッチすればokだった。