AWS API Gateway - get Cognito user groups to custom authorizer

Question

I am using a Cognito user pool with user groups and I have an AWS API Gateway with a custom authorizer. The authorizer can generate a valid IAM policy and things go well so far. I would like to generate more specific IAM policies based on user groups but I cannot get the user groups information in the authorizer. My integration request mappings are:

"groups" : "$context.authorizer.claims['cognito:groups']"

but in the authorizer I get

"type": "TOKEN", 
"authorizationToken": "...", 
"methodArn": "arn:aws:execute-api:eu-west-1:...:.../test/GET/bills"

How can I get the user groups attribute in the authorizer?

RastoStric · Accepted Answer · 2017-02-09 12:02:20Z

3

The puzzle solved: the mappings were OK, but they are actually a "bridge" between the API Gateway and the lambda, so they delivered the information to the "target" lambda function and not to the authorizer, which is a sort of "interceptor" in this case.

The way to get the user groups in the authorizer is to call

CognitoIdentityServiceProvider.adminListGroupsForUser()

which works fine for this purpose.

answered Feb 9, 2017 at 12:02

RastoStric

3105 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Aaron McMillin Over a year ago

Call that from where? In the Authorizer?

RastoStric Over a year ago

@AaronMcMillin Yes, I call that in the authorizer.

Skate to Eat Over a year ago

How did you get Cognito username to call adminListGroupsForUser() within authorizer.js?

RastoStric Over a year ago

@Ohsik username if a part of the token payload.

Collectives™ on Stack Overflow

AWS API Gateway - get Cognito user groups to custom authorizer

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related