CODEWITHSUNDEEP
amazon-web-servicesaws-lambdaamazon-dynamodbaws-api-gatewayamazon-cognito
Irving Ulises Puga Gutiérrez
Irving Ulises Puga Gutiérrez

Reputation: 23

How to grant access only to user-specific resources (DynamoDB, S3) when calling a Lambda function from an API Gateway method using Cognito

I'm creating a serverless backend using AWS (Lambda, Cognito, API Gateway, DynamoDB, and S3).

I have a Users Table on DynamoDB and an API (Lambda and API Gateway) for accessing that data. I want to grant access to the table at row level, based on the Cognito user credentials.

How can I do this? Should I use IAM policies or should I check if the id from Cognito is equal to the DB Table row id inside the Lambda?

Upvotes: 2

Views: 631

Answers (1)

Ninad Gaikwad
Ninad Gaikwad

Reputation: 4480

You can use cognito to grant access to user specific data in both s3 and DynamoDb. The sub variable in your identity pool (different from the one in user pool) can be dynamically written into your authenticated role policy. So if you have the sub variable in your dynamodb document and as a prefix to your s3 object (basically "folder" name in which you keep files), you can use a single policy to grant access based on which user is logged in.

You can find the complete steps to do this in the following blog post.

https://aws.amazon.com/blogs/mobile/building-fine-grained-authorization-using-amazon-cognito-user-pools-groups/

Upvotes: 1

Related Questions