I am new to the AWS ecosystem, coming over from Firebase. I needed a step up in configuration, and especially permissions. This might be an obvious question, but I'm not sure how to reason about it...
My Problem
I am trying to build an app that will have dozens, perhaps around 100 different permissions to perform different actions. I plan on implementing these with IAM policies on AWS Cognito Identity pools, since a maximum of 25 attributes and 25 groups won't be enough for the number of distinct permissions that I will be dealing with. How could I go about letting the front-end UI know what permissions any given user has?
If, for example, I had all of the permissions listed in the attributes, then that would be easy; I would just check the user's JWT and read out the attributes and update the UI to hide the actions user's don't have access to. Same thing goes for groups. But I am not sure on how this could be done for IAM policies?
I am aware that an option would be to just query a backend endpoint when the user tries to perform an action, and if permission is denied, then warn the user...but that is, in my opinion, a terrible UX.
I can also imagine that you could have some kind of endpoint, let's call it getUserPermissions, where when you call, a lambda function retrieves the IAM policies, parses them, and returns some permissions' describing object back to the front end. But doing this feels awkward, and might lead to outdated permissions if one forgets to query the endpoint. Is this the best/only option?
Any tips would be much appreciated.
Please note I also purposefully didn't mention what front-end (web, native, etc.) or backend I am using, because I would like to know in the general case how this works