仅将安全的AWS s3上传到高级用户？

Question

I'm trying to build an application that has a "premium" feature to upload files to s3.

Right now the users login using OAuth/Cognito. There is a dynamoDB table that contains user data based off their cognito id. That dynamodb user data specifies if the user is a premium user or not.

I have an API gateway endpoint tied to a lambda function that creates the pre-signed s3 upload url.

How do I ensure the individual who calls API gateway is logged in and is a premium user before I return the pre-signed url?

Answer 1

Create a Lambda custom authorizer that verifies the user is a "premium" user before authorizing the request to the API gateway endpoint. This function would lookup the user in DynamoDB before authorizing access.

Answer 2

It looks like you are using Cognito Federated Identities, you can access the Cognito Identity Id from your Lambda function behind API gateway, and do the lookup in your dynamo table.

In order to access the Cognito Identity Id, you must have "Invoke with caller credentials" on the API Gateway "Integration Request" page of the API.

Once this is set, and you are calling your API using the credentials from Cognito, the lambda context will have a new "identity" struct, containing the "cognitoIdentityId" and the "cognitoIdentityPoolId"