用户通过cognito身份验证后，如何通过用户凭据访问s3存储桶？

Question

I am using javascript sdk in node env and want to be able to assign a "key"/folder per user. I am able to authenticate and get a token with cognito. However with the following rules set I get a access denied. How do I actually pass the credentials on to access the users object?

Policy is as follows in IAM:

 { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "s3:Get*", "s3:List*", "s3:Put*" ], "Resource": [ "arn:aws:s3:::myBucket", "arn:aws:s3:::myBucket/*" ], "Condition": { "StringLike": { "s3:prefix": [ "${aws:username}/*" ] } } } ] } 

Answer 1

Your policy is wrong.

Here is how to fix it: Once you have cognito setup in AWS console, you will get two roles, auth cognito role and unauth. Go to the auth role in IAM and resource to look something like this...

"Resource": [ "arn:aws:s3:::mybucket/Users/${cognito-identity.amazonaws.com:sub}",]

The cognito identity: sub part is what ties the folder to the authenticated user.

Then in node, when you do put or get just use the same key but where this is -- ${cognito-identity.amazonaws.com:sub pass the identityID of the user. I am not sure how to get the identityID from AWS console, but you can definitely get it using the cli. Just check out the cognito api section to see how to get the identityID.

Hope that helps.