Cognito用户池用户的其他授权逻辑

Question

If I use AWS Cognito User Pools, isit possible to specify roles of a user then check if this user has a specific role eg. Admin, Before he/she is able to access a resource eg. API Gateway

Answer 1

You can use groups in Cognito User Pools and validate in custom Authorizer that the user is in adminGroup:

  if (payload['cognito:groups'] &&
    payload['cognito:groups'][0] === 'adminGroup') {
    admin = true;
  }

The payload here is what you get from identity token. If there is no cognito:groups, then the user is not in any group.

Another option is to take advantage of custom attributes in User Pools (the logic for validation in the Authorizer should be similar to the logic above).

Other solutions are also possible, but those are external to User Pools (eg keep track of user roles in external DB).

Whether it is groups or custom attribute (or other solutions), you would have to validate the user role in the custom authorizer. This way, the request will arrive to the custom Authorizer before API Gateway endpoint. If user should be admin, but he is not (not in adminGroup or doesn't have custom attribute 'admin'), you issue deny policy in the authorizer.

Hope this answers your question.