Obtaining Cognito JWT token for a user authenticated via Google

To generate a JWT token for a user authenticated via Google (or any other third-party identity provider) in Amazon Cognito, you'll need to follow these steps:

1. Set up an Identity Pool in Amazon Cognito: This allows you to create unique identifiers for your users and provide them with temporary AWS credentials.

2. Configure Google as an authentication provider in your Identity Pool: You'll need to provide your Google app's client ID.

3. After successfully authenticating the user with Google and verifying their token, you'll use the Google ID token to get Cognito credentials.

4. Use these Cognito credentials to obtain temporary AWS credentials, which include the JWT token you're looking for.

Here's a general outline of the process in Python:

1. After verifying the Google token and getting the user's information:

from boto3.session import Session
from boto3 import client as boto3_client

identity_pool_id = 'your_identity_pool_id'
google_token = 'google_id_token_from_previous_steps'

# Get Cognito ID
cognito_client = boto3_client('cognito-identity', region_name='your_region')
cognito_id = cognito_client.get_id(
IdentityPoolId=identity_pool_id,
Logins={'accounts.google.com': google_token}
)

# Get Cognito Credentials
credentials = cognito_client.get_credentials_for_identity(
IdentityId=cognito_id['IdentityId'],
Logins={'accounts.google.com': google_token}
)

# The JWT token is in the credentials['Credentials']['SessionToken']
jwt_token = credentials['Credentials']['SessionToken']

This process allows you to obtain a JWT token for your Google-authenticated user without needing a password in Cognito. The token can then be used to authorize the user in your application and grant access to AWS resources as needed.

Remember to handle token expiration and refresh appropriately in your application logic. The Cognito credentials are temporary and will need to be refreshed periodically.

Also, ensure that you've properly configured your Cognito Identity Pool to trust the Google identity provider and that you've set up the necessary IAM roles and policies to control what AWS resources the authenticated users can access.
Sources
CognitoIdentity - Boto3 1.34.114 documentation
Authentication with a user pool - Amazon Cognito

The above suggested code returns a session token like: IQoJb3JpZ2luX2VjEGIaCWV1LXdlc3QtMSJHMEUCIC6TvVdf9k0b9rk5svV2REW60cx0entOtUL1PULb9RzyAiEAz4VVAOfRTwgDfZ2AjJ9lkTJ7F4lIxcan8L3s0f7QJXkqsQQIu///////////ARAAGgw4NTE3MjU1NTc4NjMiDJqqUuMmEqq/Nflx0SqFBMYnhZoyOgCpECznJZEhCmo2GL9Dffo4NS0I0Doo/AKCrG8RMFMV8MCVhlibHQC6xtr9VX+0bZFwvAXA5TRUdtBSLytXt1e8XYaraBq3BhU5pJeYgW+PnYB62XXaCAUO22Sbv3Ni+RU+blNfEFK8tDQFLZFO8mBx9uwrg54t3JIzv3xwUgGVKo317ixobHEgGIOOez753l+3D2RvaG3EGqtbVS6XFRBzJw7CdYqffGnXkjUu2+AFMNeO+A3bs28mgfx74jSA6ISff2DxofOJzDyqfjnWv/yY8LEhNbANQEhPMqRZCjKZfxooZN8IM/JaGItwWk0sEdg4e1M01PHXUcsrVSc1EAYT7d6K0u5Tj4S+i/P52hQYgacsRc6CcMGZuGF1G5ZNvfCr4TJ16IiRZ8+C1CWHFJi8u8zNCTXfP3/ILtkC/NgAdBRI6VpQD49vNBb/7L+TRqt2Y7yqBcQkyWcMzAA2C3269WdfjIIIaPAdiPofp2mj2zvESHARzsq2Q5SxlxI1UyIR+t+AJmRUqnMDsB93DS/xE5BFsNAgfapmBT1pcKXmXmAXNX3X5OKuisitBnESGUxYUi3ppqprFyAi4RAWRtwVsl66WFPEd/rmTP+guZN/cFwepl8oCCItZyb24tlsPJwaWeGuw740XcF1a3D/UC5yyNvJXp6SddnQz8I81w8wta6uuAY6hQJvZP5iSG4mAbn4DoCX6jhBoHY9KsRmJTyDxT+u5coWiTMXRSnH6uJh+2b8+3aufZC0Z+8onl/9Hv4lOR9DB6VbsWVuEWkCDnjzMWvkOqnbUcQnZ/TNLuGErzsdzurSZ+jSQPDRKq/qkfaMtozEsq/WY09xW4I9hwmkRQ6cW34HZayJOl/TpqwnaTeW/eHVDN2hZzl69Yf8cmcZfX11AJiXiIJxgbmyA5C+44oPMJcVUGWlna3oUKGaOSVwJHwUVKOrQ8p7O6yw+tSqHTsjcXosWm00nRulm7uTkEj9qWY8voknEWgIBowOEc3DRsucRgWylEaBmqCF242l/YRWOXJuO6e1N9s=

Which is different to the JWT token I can use as a Bearer.

Is there any update here? I am getting the same session token response. Not compatible with my services expecting a jwt from Cognito.