Cognito Authorizer groups

Question

I have a Single Page Application in Angular, an API Gateway with Lambda for the backend services and Cognito User Pool for Authentication and Authorization.

Access to certain API endpoints depends on the users role. You can attach an IAM role to the group with (execute API invoke for the Api Gateway resources) policies.

However, using Cognito as Authorizer for the API Gateway only checks if the user is Authenticated (by passing the ID Token in the Authorization header, this token is returned from Cognito user pool after a succesfull login), before it can call the API. The group the user is in, won't be used to check it's group and the IAM permission it has.

Is there a good way, to authorize my web users, to call certain API endpoints based on their role, instead of creating a Lambda (custom) Authorizer.

I don't want to use AWS signature V4 for an API Gateway with an IAM Authorizer. I also don't want to create Lambda Authorizer, that validates the ID Token, check the role attached to it and returns a policy based on that role.

Can't I just use the roles I have configured for the Cognito groups, in combination with Cognito Authorizer to have access to the API endpoints based on the attached role / policy for that group?

Or is there another user friendly way?

Answer 1

You are right, cognito will only validate the token and not the IAM/Group permissions. So, if the token is valid, the client can access the api. I was struggling with the same and then ended up writing a custom lambda authorizer.

Here is what I have done.

1. Maintain a Group to Resource mapping in the database. Additionally Resource to Action(GET/POST etc).
2. The Group name in cognito must match the one in database.
3. In lambda authorizer you can check if the incoming resource, group and action combination is present in the database and return a policy that enables access to the resource.
4. you will also need to validate token signature and expiry.