AWS Amplify and AWS Cognito: Assignment of users to multiple roles

Question

I have an Angular application in which users should be assignable to multiple roles. In Cognito, it appears as though groups take the place of roles, but I don't see how to assign users to multiple groups/roles. 1) Is that possible, and if so, how? 2) Is it possible to programmatically assign users to roles? And 3) is role assignment implicitly verified on each API request? Thanks.

Tim_J · Answer

1. It is possible to assign users to multiple groups; see: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-user-groups.html and https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-user-groups.html#assigning-precedence-values-to-groups

2. [The call is AdminAddUserToGroup](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminAddUserToGroup.html).  This would be done in a PostConfirmation lambda hook. Some [code examples](https://github.com/search?q=org%3Aaws-samples+AdminAddUserToGroup&type=code) from the `aws-samples` github org or [stackoverflow](https://stackoverflow.com/questions/49984024/aws-cognito-amplify-have-new-user-sign-ups-be-automatically-add-to-a-user-grou).

3. See your [other question](https://repost.aws/questions/QUcc2X4r4BQlaZfrLb-NR-NQ/aws-amplify-and-aws-cognito-website-subscription-verification).

Steven_G · Answer

It's not that Cognito uses groups instead of roles, it's that you can use Cognito to map roles to group memberships based on the claims present in the id token that's generated upon authentication. See [here](https://docs.aws.amazon.com/cognito/latest/developerguide/role-based-access-control.html) for more.

AWS Amplify and AWS Cognito: Assignment of users to multiple roles

Relevant content