使用 IAM 授权方的服务到服务 API 调用

Question

I have a Lambda with API Gateway and an IAM Authorizer for authorization. I'm currently calling it from the frontend using Cognito (Identity Pool). I don't know if this is relevant but the endpoint is a proxy for an external system and ultimately maps the logged in user's identity ID with the external system's JWT to facilitate REST calls.

Here is my issue, the REST interface I described above needs to be called by another Lambda with a similar setup ie it has an IAM authorizer / API Gateway, and called by the frontend using Amplify and Cognito.

How can the lambda assume the role of the Cognito user (IAM User) that made the request and call the other REST interface with the IAM authorizer?

Answer 1

I think I am going to use a JWT authorizer and change my unique user ID to be the sub of the userpool.

I believe the answer to my own question is using the identity id and the amazon secret and construct the same header to call the API.