AWS S3: private access using id_token from Cognito like to the ApiGateway: is it possible?

Question

I successfully setup access to the Lambda using token_id from Cognito - client adds header Authorization: <token_id> and Api Gateway validate this token. I hope that I can setup similar access to the S3 from the client browser. For that I wrote policy for the S3 bucket (every user has its own directory for files):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "cognito-identity.amazonaws.com"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::buc/${cognito-identity.amazonaws.com:sub}/*"
        }
    ]
}

I tried this call:

curl -v --header 'Authorization: [id_token_from_cognito_after_signup]' https://s3.amazonaws.com/buc/<sub>/myfile.jpg

That return 400 Authorization header is invalid -- one and only one ' ' (space) required . On the web I found that this error can be unrelated to the spaces - because this request has the correct amount of spaces (I tried request without spaces too).

It is interesting that in the documentation about S3 is not mentioned Cognito.

I do not want to use js sdk on the client for speed and simplicity.

Answer 1

You were able to access your API using the cognito token because of the integration of cognito in API Gateway as it is fully described in aws blog

The Cognito user pools integration with API Gateway provides a new way to secure your API workloads

However, as of today, there's no such possibility for S3. You would need to compute the signature yourself as it was explained in the doc you reference. (various examples are referenced here )

Answer 2

Have you tried this policy mentioned here

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::<BUCKET-NAME>"],
      "Condition": {"StringLike": {"s3:prefix": ["cognito/<APPLICATION-NAME>/"]}}
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": [
        "arn:aws:s3:::<BUCKET-NAME>/cognito/<APPLICATION-NAME>/${cognito-identity.amazonaws.com:sub}",
        "arn:aws:s3:::<BUCKET-NAME>/cognito/<APPLICATION-NAME>/${cognito-identity.amazonaws.com:sub}/*"
      ]
    }
  ]
}