How enforce group limit access in AWS Cognito

Question

Let's assume I have 1 userPool and 2 groups: group_a and group_b.
A user can be in group_a or in group_b or without a group.

Using cognito API how can I implement access control following the following rule:
group_a users can ListUsers of every user in the pool.
group_b users can ListUsers of users from group_b and without a group.
Users without a group can't ListUsers.

Reading through AWS docs, I couldn't find a way to do without managing 2 userPools and cross the identity pools and roles.
Is it possible to do it in a single UserPool?

user_6941447 · Answer

I don't believe this is supported out of the box. IAM policies don't have any request conditions that check for group that a user belongs to. Also, list user returns all users and if you need any filtering you need to do it after fetching all users. I would suggest you build APIs to handle this which check for group in the token and then return users that the group has permission to view.

How enforce group limit access in AWS Cognito

1 Answers