By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Cognito User Pool Groups and retrieving IAM from Lambda

0

A customer is building a serverless solution. Clients would make an api call, trigger custom authorizer/lambda using request parameter, and authenticate the user in the user pool. However, to generate a policy doc, they don't want to grant a blanket 'Allow' to the request. They want to apply IAM policies to user groups in cognito, and pass that to lambda authorizer. Has anyone encountered this? How to retrieve the Iam role/policy attached to the group in cognito user pools?

Topics
ServerlessComputeSecurity, Identity, & ComplianceFront-End Web & MobileNetworking & Content Delivery
Tags
AWS LambdaAWS Identity and Access ManagementAmazon API GatewayAmazon Cognito
Language
English
AWS
rabinon
asked 6 years ago470 views
1 Answer
0
Accepted Answer

It seems like they're trying to fight the conventional pattern. Serverless or not, why would they not authenticate & authorize the user directly via Cognito first, and then use the Cognito JWT as authN/Z to the api call? Everything they are after (group based policies, access control on the api) is essentially trivial if they do the identity bits first.

EXPERT
Quint Van Deman
answered 6 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content