I have set up aws cognito and would like to use their federated identities to authenticate users against my own database but on getting a token after calling the get_open_id_token_for_developer_identity() and then calling the get_credentials_for_identity() the response is identityID , AccessKey , clientSecret and session token but this accesskey and client secret do not match the security credentials for my root user or even the IAM users and when used in postman with the AWS SIGNATURE authorization it throws an unauthorized error . I am getting the credentials after calling the get_credentials_for_identity() using identity id and in login{"cognito-identity.amazonaws.com":<token_from_get_open_id>} but the response which includes accesskey and client secret does not let me hit the api now secured using cognito
What is the access key Id and Secret returned in get credentials for identity call in aws cognito?
Viewed 437
1 Answers
this accesskey and client secret do not match the security credentials for my root user or even the IAM users
These are new and temporary credentials not linked to your root or other IAM users in your account. From docs:
You can use Amazon Cognito to deliver temporary, limited-privilege credentials to your application, so that your users can access AWS resources.
This is explained more here:
When a user logs in to your app, Amazon Cognito generates temporary AWS credentials for the user. These temporary credentials are associated with a specific IAM role. The IAM role lets you define a set of permissions to access your AWS resources.
Related