Cognito user group can not invoke API GW - amazon-web-services

Question

I am new in AWS Cognito topic. I am using IaC - Pulumi Typescript for deployment to AWS.
the purpose is to create two users(user1 and user2) and and give access only one user to invoke API GW.
// Create a Cognito user pool
const userPool = new pulumiAws.cognito.UserPool('my-user-pool', {});
// Create a Cognito user pool client
const userPoolClient = new pulumiAws.cognito.UserPoolClient('user-pool-client', {
userPoolId: userPool.id,
explicitAuthFlows: ["USER_PASSWORD_AUTH"],
});
//Create the first user group
const group1 = new pulumiAws.cognito.UserGroup('group1',{
description: 'Group1',
userPoolId: userPool.id
})
//Create the second user group
const group2 = new pulumiAws.cognito.UserGroup('group2',{
description: 'Group2',
userPoolId: userPool.id,
})
//Create the first user
const user1 = new pulumiAws.cognito.User('user1',{
username: 'user1',
password: 'TestUser1!',
userPoolId: userPool.id,
})
//Create the second user
const user2 = new pulumiAws.cognito.User('user2',{
username: 'user2',
password: 'TestUser2!',
userPoolId: userPool.id
})
//Assign the user1 to the group
const user1GroupMembership = new pulumiAws.cognito.UserInGroup('user1-group-membership',{
groupName: group1.name,
userPoolId: userPool.id,
username: user1.username
})
//Assign the user2 to the group
const user2GroupMembership = new pulumiAws.cognito.UserInGroup('user2-group-membership',{
groupName: group2.name,
userPoolId: userPool.id,
username: user2.username
})
const authorizer = new pulumiAws.apigateway.Authorizer("my-authorizer", {
restApi: api.id,
type: "COGNITO_USER_POOLS",
identitySource: "method.request.header.Authorization",
providerArns: [userPool.arn],
});
const method = new pulumiAws.apigateway.Method('method', {
authorization: 'COGNITO_USER_POOLS',
authorizerId: authorizer.id,
httpMethod: 'GET',
resourceId: resource.id,
restApi: api.id,
authorizationScopes: [user1GroupMembership.groupName],
});
Now I expect that the token which I created by using user1 credentials can be able to invoke API GW , but I get Unauthorized error.
On the other hand , if I remove authorizationScopes: [user1GroupMembership.groupName], from apigateway.Method(the code piece is in the above) then I can invoke the API GW via of course both user1 and user2 users.
Could you please give an idea how can give access only group1 or user1 to invoke API GW? what is wrong I am doing there.
Best Regards

Answer 1

I think that either user 1 or user 2 will be able to contact the Gateway API. However, you can set up an authorization mechanism with the implementation of a lambda authorizer which will be in charge of authorizing only the requests of the users of the group 1