aws cognito - is it possible to use the role-based permission control without using identity pool

user_10686620 0
Viewed 91

Background

I am using the Amplify Framework(javascript) for Register/Login in my frontend website.

Register

            Auth.signUp({
                username,
                password,
                attributes: {
                    email: email
                }
            })

Login

Auth.signIn(payload.username,payload.password)

Every time user login, the cognito id token will be stored in localStorage for accessing API in API Gateway.

This is my API Gateway api setting. enter image description here enter image description here

Every successfully logged-in user can call ALL api, for the current design.

Question

Now I want to do role-based permission control on calling the api, e.g. role banner_admin can only call /banner api, while role equipment_admin can only call /equipment api.

After some research, it seems Identity Pool is able to achieve this. But I don't want to change my Login Flow.

Can someone provide the fastest and convenient way to achieve the role-based permission control in my application? Is it possible to NOT use identity pool?

amazon-cognito amazon-web-services
1 Answers

Yes, it's possible to do this without using Identity Pools service. Actually, Identity Pools is not one to use for this purpose.. It's just exchanging the temporary credential to the authenticated or unauthenticated user to access your AWS resources..

You should use Groups supported by Cognito User Pool service for this purpose. Once the user would be authenticated by Cognito, the claims he's get will include group information he belongs to(If you added the user to a specific group in User Pool). You can handle the permission based on this group.

Upon the post confirmation Cognito event, You can trigger your lambda function, then there you can add the user to the corresponding user group in background.

user_82642800
Related