Cognito Identity with OpenId Provider and Conditional DynamoDb Policy - amazon-web-services

Question

i use a custom open id provider and aws accept my tokens and i'm able to use coginto identity pools to limit the access to my dynamodb database. My problem is that when i use coginito identity with dynamodb:LeadingKeys -> ${cognito-identity.amazonaws.com:sub}' it always prepend the aws-region before my userId: Example: eu-central-1:1234567
In my database design i only need the userId (without the region) as the primary. Are there any possibilities to remove the region from sub. i already tried to change the Condition to my custom openid provider (like the documentation described) - but this always don't work
my Policy:
- Effect: Allow
Action:
- dynamodb:DescribeTable
- dynamodb:Query
- dynamodb:GetItem
- dynamodb:PutItem
- dynamodb:UpdateItem
- dynamodb:DeleteItem
- dynamodb:BatchWriteItem
Resource:
- arn:aws:dynamodb:eu-central-1:123:table/table
Condition:
ForAllValues:StringEquals:
dynamodb:LeadingKeys: ${custom.open.id/openid:sub}
My Javascript code looks like this:
const Logins = {}
Logins['custom.open.id'] = accessToken; // my own openId access JWT Token
// Add the User's Id Token to the Cognito credentials login map.
const credentials = new AWS.CognitoIdentityCredentials({
IdentityPoolId: identityPoolId,
Logins: Logins
});
return credentials.getPromise()
.then( error => {
if (error) {
return Promise.reject(error)
}
if (credentials.needsRefresh() === true) {
return credentials.refreshPromise()
}
return null;
})
.then(error => {
if (error) {
return Promise.reject(error)
}
console.log('Successfully logged!', credentials.data);
const dynamoDb = new AWS.DynamoDB.DocumentClient({
credentials: credentials,
region: region,
});
const params = {
TableName: "table",
KeyConditionExpression: "#userId = :userId",
ExpressionAttributeNames: {
"#userId": "userId"
},
ExpressionAttributeValues: {
":userId": currentUserId
}
}
return dynamoDb.query(params).promise();
})
.then(data => {
console.log("DynamoDb", data)
})
And the content of my JWT Access token is:
{
"sub": "123",
"nonce": "VRN3voQIhS6Nb6AzSsv907GxPnKc0szo",
"sid": "4fd7fd36-5a36-40e6-b381-b004a52be473",
"at_hash": "wF9BX32r6yQqvV5j0QGj8g",
"s_hash": "NzqHNkNF7FfCJa1tKudjTg",
"aud": "test_client",
"exp": 1556560701,
"iat": 1556557101,
"iss": "https://custom.open.id/openid"
}

Answer 1

The Sub in this IAM JSON is the Identity ID. An Identity ID is defined as a unique Identity for each user attempting to get credentials via a Cognito Identity Pool.
There is no way to change the pattern of an Identity ID, as the format is predefined by Cognito's architecture. For more details on Cognito Identity Pool's Roles and Policies, kindly refer to this official AWS Blog Post.