How to add/suppress custom scope in AWS Pre-Token Generation trigger ?

Question

I have `Cognito user pool` with one Allowed custom scopes for my app client i.e. ` admin-only`. I have two kinds of users `1. Users in Admin Group 2. Non-Admins users.` For my one of the AWS API Gateway Routes, I need to deny the access if user from non admin group is hitting the API Url, basically its allowed only for users which are part of Admin User group.

I can achieve it through adding an `Authorization scope` on `API gateway` route with this custom scope and then adding a scope manually when I request an Authorization token in Hosted UI popup.  But in my app, I don't want to add this scope manually, rather want to add this scope when the token is generated. I explored `Pre-Token Generation Trigger` but not able to see the way to override or add scope attribute in it. Also tried below code in Pre-Token Generation Trigger lambda.

```
exports.handler = async (event, context, callback) => {
event.response = {
        "claimsOverrideDetails": {
            "claimsToSuppress": ["admin-only"]
        }
    };
    callback(null, event);    
};
```

Question is, is there a way to add/override custom scope in pre-token generation trigger ? If yes then how ? But if there is no way, then how to solve my use case ?

Answer

You're definitely heading in the right direction, you can use the Pre-token generation Lambda trigger to add claims to your ID tokens. You would use the 'claimsToAddOrOverride' property for that. You can find more information here in the documentation here.

I've created a sample application in the past which demonstrates how to add a 'department' claim (and use it for ABAC), it might give you an idea on how to implement it. The repository is here, and in particular, the pre-token-trigger.js shows how to use the 'claimsToAddOrOverride'.

Hope that helps :)

I've created a sample application in the past which demonstrates how to add a 'department' claim (and use it for ABAC), it might give you an idea on how to implement it. The repository is [here](https://github.com/aws-samples/amazon-cognito-abac-authorization-with-react-example), and in particular, the [pre-token-trigger.js](https://github.com/aws-samples/amazon-cognito-abac-authorization-with-react-example/blob/main/resources/pre-token-trigger.js) shows how to use the 'claimsToAddOrOverride'.

Hope that helps :)

Answer

As of 18-Dec-2023 custom claims can also be added to the access token. Here's the announcement:

https://aws.amazon.com/about-aws/whats-new/2023/12/amazon-cognito-user-pools-customize-access-tokens/

How to add/suppress custom scope in AWS Pre-Token Generation trigger ?

Relevant content