AWS Cognito workaround for aws:username

Viewed 295

I am writing a user policy using AWS Cognito User Pools for an app that needs to be compatible with an old ad hoc user management system we had previously used on S3 with IAM while we move to a better user management model using Cognito.

The old system used arn:aws:s3:::[Our Bucket Name]/${aws:username}/* in the group policy to only allow a user access to objects using their username. I had thought that using the same username in Cognito would allow us to use a duplicate role policy allowing the Cognito users the same access, but according to this, the aws:username is not present for Cognito; that only has the aws:userid, which, if I am reading this right, is essentially a randomly generated unique string that has nothing to do with the username and so cannot be used for this purpose.

Is there any other way I can give the Cognito user access to a given IAM username's folder in S3 on the basis of the same name through a role policy? The only way I can think of is to make custom policies on a per-user basis, but I would prefer to keep changes to our existing user creation system to a minimum.

1 Answers

Short answer: don't mix IAM with Cognito. Write an app/service/api to provide the objects to the authorized user.

Long Answer: IAM is for admins or services of AWS. Do not mix it with the Cognito. Cognito is for storing and providing tokens to your users. You might ask how to provide the objects within bucket-name/user-test to user-test:

  1. Store User Access Rights in S3: For each user have a bucket access-rights/user-test. It should conclude the user rights; for example you can have as a Json:

    { username: string, access-bucket-name: string }

  2. Additional Service: You can have authentication service to check the user is authenticated (using Cognito), then based on the body of the token, get the username; and check its rights (first step) and the application should provide the object from the initial bucket the user wants to access.

Related