How to pass Cognito user info to a Lambda function

Question

Hello,   
  
I am using a Cognito user pool authorizer in my REST API.  
  
I am trying to pass the Cognito user information (e.g. username, user group) from the API Gateway to a Lambda function, i.e. passing it in the 'event' or 'context' of the request.  
  
My goal is to query different databases (test/dev/etc.) according to which user group the caller belongs to.  
  
What is a good way to proceed in this case?  
  
I saw the 'invoke with caller credentials' checkbox in the API Gateway, but it cannot be checked with a Cognito UP authorizer. I also tried switching from a Cognito authorizer to IAM, but don't know what execution role to select.  
  
Any help would be greatly appreciated.

Answer

I found out: I had to check the "Lambda proxy integration" checkbox in the Integration request of the method.  
  
Then the Lambda can fetch the user info from the event object of the lambda handler (e.g. in Python):

```
event['requestContext']['authorizer']['claims']['cognito:groups']
```

(or: 'cognito:username', etc.)  
  
Then I could query different databases according to which group the user belongs to.  
  
Additional info: it is also possible to assume the user role from within the Lambda function, to make sure to access only what's the user is allowed to (by default only the Lambda function's role is assumed to execute actions); this is very well explained at https://www.youtube.com/watch?v=GDkkDUnICrs

How to pass Cognito user info to a Lambda function

相關內容