Retrieve identityID given userpool ID_token in lambda@edge

Question

Hi,

I have a CloudFront viewer request lambda@edge function that returns a custom cloudfront policy after verifying a cognito userpool id_token. The custom policy would grant access to read files from a user directory of the form /users/ where the identityID is based on the cognito identity pool. I have the following in my lambda function to get the identityID associated with a userpool id_token.
```
      AWS.config.credentials = new AWS.CognitoIdentityCredentials({
        IdentityPoolId: ,
        Logins: {
                : id_token
            }
     	});
      await AWS.config.credentials.getPromise();
      identityId = AWS.config.credentials.identityId;
      console.log(identityId)

```
This seems to work, but I ran across an issue where the lambda@edge function was spun up in us-west-1, while my identity pool (and user pool) are in us-west-2. For some reason, I get an error that the identity pool can not be found. Are these region specific? I have no issues when the lambda function is run in us-west-2. Is there another way to get the identityID from the id_token?

Answer

Yes, Amazon Cognito is a regional service, see https://docs.aws.amazon.com/general/latest/gr/cognito_identity.html#cognito_identity_region. You may need to use the full Arn or specify the endpoint in your code even though the the region is part of Identity Pool Id.

Answer

Have you set the "region" in the SDK? If you don't do this lambda will send the call to in-region endpoint anyway.

Answer

Did that work or are you still getting an error?

Retrieve identityID given userpool ID_token in lambda@edge

Relevanter Inhalt