Unauthenticated Cognito Profile restriction

Question

Hello,

We are looking for recommendation that can help on the below part:

We have integration of Salesforce with SDK part where Cognito Profile is leveraged 
for S3 bucket access. Now we looking for thing that ensure users are authenticated and authorized to only intended functions and information from the bucket.

Also, like to understand how can be Policy and IAM Role(Auth_Role and UnAuth Role) used to restrict the access ? Or they have some other purpose.

Thanks

Answer

Hello

If I understand your question, you are looking for some guidance on  Role-based control access 
[This document ](https://docs.aws.amazon.com/cognito/latest/developerguide/role-based-access-control.html )  could help you with that.

As you will see on that link, you can map either authenticated or unauthenticated users and allow them to assume a specific role. You can specify default IAM roles for authenticated and unauthenticated users using cognito.  When Amazon Cognito creates a token, it sets the **amr ** of the token as either "unauthenticated" or "authenticated", and in the authenticated case will include any providers used during authentication.

It is important to add the appropriate trust policy for each role so that it can only be assumed by Amazon Cognito for authenticated users in your identity pool. Here is an example from the article  of such a trust policy:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "us-east-1:12345678-corner-cafe-123456790ab"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "authenticated"
        }
      }
    }
  ]
}

```
This policy allows federated users from cognito-identity.amazonaws.com to assume this role. Additionally, the policy restricts the **aud **of the token, in this case the identity pool ID, to match the identity pool (as I mentioned before in the authenticated case will include any providers used during authentication). Finally, the policy specifies that one of the array members of the multi-value **amr ** claim of the token issued by the Amazon Cognito GetOpenIdToken API action has the value authenticated.

Take care and stay safe,
Best regards,

Igvir

Unauthenticated Cognito Profile restriction

Relevant content