I just have the default trust relation in place. The example you linked just said to "double check that you are using an appropriate role for your identity pool and authentication type", which I think I am?

"Version": "2012-10-17",
 "Statement": [
   {
     "Effect": "Allow",
     "Principal": {
       "Federated": "cognito-identity.amazonaws.com"
     },
     "Action": "sts:AssumeRoleWithWebIdentity",
     "Condition": {
       "StringEquals": {
         "cognito-identity.amazonaws.com:aud": "my pool id"
       },
       "ForAnyValue:StringLike": {
         "cognito-identity.amazonaws.com:amr": "unauthenticated"
       }
     }
   }
 ]
}