Cognito User Pool Groups and retrieving IAM from Lambda
A customer is building a serverless solution. Clients would make an api call, trigger custom authorizer/lambda using request parameter, and authenticate the user in the user pool. However, to generate a policy doc, they don't want to grant a blanket 'Allow' to the request. They want to apply IAM policies to user groups in cognito, and pass that to lambda authorizer. Has anyone encountered this? How to retrieve the Iam role/policy attached to the group in cognito user pools?
- Topics
- ServerlessFront-End Web & MobileComputeSecurity, Identity, & ComplianceNetworking & Content Delivery
- Language
- English
asked 8 years ago775 views
- Newest
- Most votes
- Most comments
It seems like they're trying to fight the conventional pattern. Serverless or not, why would they not authenticate & authorize the user directly via Cognito first, and then use the Cognito JWT as authN/Z to the api call? Everything they are after (group based policies, access control on the api) is essentially trivial if they do the identity bits first.
Relevant content
asked 3 years ago
asked 4 years ago
