Add authorization to to function created with amplify cli - amazon-web-services

Question

I've created a lambda function to add new users created in my React app to a group in my cognito user pool.
I used this guide from the docs to be able to call the the lambda function via AppSync.
Now when I run the function I get the following expected error:
User: [redacted] is not authorized to perform: cognito-idp:AdminAddUserToGroup on resource: [redacted]
So far I've added this additional policy to the role in CustomResources.json:
{
"PolicyName": "CognitoAuthLambdaFunction",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["cognito-idp:AdminAddUserToGroup"],
"Resource": [
{
"Fn::Sub": [
"arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:setUsersGroup-${env}",
{ "env": { "Ref": "env" } }
]
}
]
}
]
}
}
How do I dynamically reference the cognito user pool so that I can switch between envs?

Answer 1

I assume the policy you've given in the question is the Lambda Execution policy, i.e. the one passed to Lambda at runtime. This policy will authorise your code running in Lambda to call the given list of API.
If my assumption is correct, there is a mistake in the policy, as the resource property refers to your Lambda function itself (ARN starts with arn:aws:lambda), while it should refer to the User Pool you want to grant access to (ARN should start with arn:aws:cognito-identity).
See https://docs.aws.amazon.com/cognito/latest/developerguide/resource-permissions.html
Assuming the Cognito User Pool is created in the same CloudFormation template, you can access the Cognito User Pool ARN using the Fn::GetAtt intrinsic function, such as
{ "Fn::GetAtt" : [ "logical_resource_id_cognito_user_pool", "ARN" ] }
See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html for attributes available on AWS::Cognito::UserPool resource type.