How to get the Cognito Identity id in AWS Lambda

Question

How can I get the identity id of the user (logged in by AWS Cognito) that invoked an AWS Lambda function? Do I have to use the SDK on the Lambda function to get the identity id?

Answer 1

In AWS javascript SDK inside lambda function just use context.identity.cognitoIdentityId It is working for me

Answer 2

If anyone else stumbles upon this, I think this will help you a lot.

Note this only applies if you're using the Cognito User Pool Authorizer. If you want to use AWS_IAM with Cognito Identitys check out my github example https://github.com/VictorioBerra/js-cognito-auth-example (read down to EDIT area below)

If you have "Use Lambda Proxy Integration" checked then you wont have access to Request Template Mappings. But you can get to the claims inside the token in your lambda function:

exports.handler = (event, context, callback) => {
    //create a response
    const response = {
      statusCode: 200,
      body: JSON.stringify({
          "user email": event.requestContext.authorizer.claims.email,
      }),
    };
    callback(null, response);    
};

EDIT - More information for using AWS_IAM as APIG authorizer

Basically you need to have your APIG secured with AWS_IAM AND you must auth via a Cognito Federated Identity which will return a sessionToken example using user pools. This is what makes the AWS IAM credentials temporary. Now you have everything you need to auth to your APIG.

To test this, download the desktop version of postman, toss in your API URI (grab this from the stages area) and then under Authorization fill out the 5 fields you need for Sig4 signing. You will see 'event.identity' object in your lambda function is loaded up with properties such as the user object.

If you want to use the APIG auto-generated SDK it comes built in with a factory that takes the accessKey, secret, and token and signs everything for you. Same with the aws-sdk. You can init the credentials with those three items and it will automatically sign all requests for you with those temp creds. If you want to straight up manually hit your API with window.fetch, request, curl, (insert http client here) you can calculate your own Sig4 (beware it can be a little complicated or use a modern library to do it for you.

Also for the record, while doing my research I noticed that if you want to NOT use AWS_IAM as an APIG authorizer, and you want to use "Cognito Identity Pool Authorizer" which is a fancy new option in the dropdown in APIG you can still get a ton of info on the user in the lambda event if you just pass the JWT gained from a successful Cognito popl auth to the APIG as the Authorization header. Inside that JWT is a lot of attributes which you can customize in your pool settings.

IMO professional opinion I think using the AWS_IAM temp creds authorizer is preferred. This way, you can use as many different IdPs as you want in Cognito Identities (Facebook, Twitter, pools, etc.)

---

Answer 3

If you go through API Gateway, you can pass the cognito id (as well as the user arn and other useful information) to Lambda. This solved the issue for me.

http://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-mapping-template-reference.html

Answer 4

Per the docs, it looks like information about the identity provider would only be available for an invoke through the Mobile SDK.

To get around this, one option is to pass the identity ID to the function manually as part of the event. Assuming you are doing something like AWS.config.credentials = new AWS.CognitoIdentityCredentials(...) then you should be able to get the ID via AWS.config.credentials.identityId (after the credentials are refreshed).

EDIT: A better option for identity validation is to let Cognito/IAM handle it, and assume that if a user can successfully invoke a Lambda function, that means they are allowed to. In this case to manage per-user validation, take a look at whitelisting.

Answer 5

For anyone else still struggling to obtain the IdentityId of a Cognito User in a Lambda Function, after many hours of exploration, I discovered that the IdentityId can be obtained within a Lambda Function in the following ways depending on the method you use to invoke the Lambda Function:

Invocation via an API-Gateway trigger with a Cognito User Pool Authorizer

The IdentityId can be obtained in the following way:

const IDENTITY_POOL_ID = "us-west-2:7y812k8a-1w26-8dk4-84iw-2kdi849sku72"
const USER_POOL_ID = "cognito-idp.us-west-2.amazonaws.com/us-west-2_an976DxVk"
const { CognitoIdentityClient } = require("@aws-sdk/client-cognito-identity");
const { fromCognitoIdentityPool } = require("@aws-sdk/credential-provider-cognito-identity");

exports.handler = async (event,context) => {
        const cognitoidentity = new CognitoIdentityClient({
             credentials:  fromCognitoIdentityPool({
             client: new CognitoIdentityClient(),
             identityPoolId: IDENTITY_POOL_ID,
                 logins: {
                     [USER_POOL_ID]:event.headers.Authorization
                 }
             }),
        });

        var credentials = await cognitoidentity.config.credentials()
        console.log(credentials)
        // {
        //    identityId: 'us-west-2:d393294b-ff23-43t6-d8s5-59876321457d',
        //    accessKeyId: 'ALALA2RZ7KTS7STD3VXLM',
        //    secretAccessKey: '/AldkSdt67saAddb6vddRIrs32adQCAo99XM6',
        //    sessionToken: 'IQoJb3JpZ2luX2VjEJj//////////...', // sessionToken cut for brevity 
        //    expiration: 2022-07-17T08:58:10.000Z
        //  }
        var identity_ID =  credentials.identityId
        console.log(identity_ID)
        // us-west-2:d393294b-ff23-43t6-d8s5-59876321457d

        const response = {
            statusCode: 200,
            headers: {
                "Access-Control-Allow-Headers": "*",
                "Access-Control-Allow-Origin": "*",
                "Access-Control-Allow-Methods" : "OPTIONS,POST,GET,PUT"
             }, 
             body:JSON.stringify(identity_ID)
        };
        return response;
}

Why?

Invoking a Lambda Function using an API-Gateway trigger with a Cognito User Pool Authorizer will result in the following fields (among additional fields which have been removed for brevity) being available in the event of the invocation:

{
    "resource": "/{proxy+}",
    "path": "/_",
    "httpMethod": "POST",
    "headers": {
        "Authorization": "eyJrmlaod8(kyC9zdspo0jZIYjRENFlCNVBidnksl89DNm9USDJrT25MSDhjXC9EYkIzMzQ8389iYWxnIjoiUlMyNTYifQ.eyJzdWIiOiI8389yNDg4Ny0wYTRdkiuiOGQtODA4My1kNmIyYzZhYWNhN2YiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLXdlc3QtMi5hbWF6b25hd3MuY29tXC91cy13ZXN0LTJfZ3dPMjlMckR4IiwiY3VzdG9tOmZpcnN0X2tleSI6ImZhbHNlIiwiY29nbml0bzp1c2VybmFtZSI6IjJjNjI0ODg3LTBhNGItNGE4ZC04MDgzLWQ2YjJjNmFhY2E3ZiIsIm9yaWdpbl9qdGkiOiI0ODEzYzk1Ni01MDM0LTQzNmItYjE5OS00MWZjN2U1ZTQ0ODciLCJhdWQiOiJyNjdwOGdxNnQ5cHJrc2JyYmtxMDVoM2NuIiwiZXZlbnRfaWQiOiJmOWRlNWMxOC0yMTNlLTQ2NDgtOGY4MC1mODdhYWJhNWM4NGUiLCJjdXN0b206YXBpX2tleV9JRCI6Imhoa2hpMmw5cTkiLCJjdXN0b206YXBpX2tleSI6InVzLXdlc3QtMjplOTBkYmUzZC0wN2FhLTRjODQtOGQ0Ny04NjJmZDJhNzQ1MGZfcm5Zalk2YmhaT0lkWXhDcDBDcjNYZWVaYzFuT3ViZnkzdEs5aEtFRFVIZ3FJd1BSTVJuQ2pyWlJYdGNBSVpqWTVnMFFyejN3ek1keGoiLCJ0b2tlbl91c2UiOiJpZCIsImF1dGhfdGltZSI6MTY1ODA0ODg1OSwiZXhwIjoxNjU4MTM2MTk3LCJpYXQiOjE2NTgxMzI1OTcsImp0aSI6IjdmNTdiYWZlLTA1ZGUtNDgwZC1hMDgzLWY1MjlhN2YzNmI2YiIsImVtYWlsIjoidHJldmVuYXc3QGdtYWlsLmNvbSJ9.hk-8ajGP2jO0RQvzwZWp2d5T1BLiWL9q6vvrbXemLBbd2kb1kkBSvklfC_7WWvJoy1ukwNoq8Cx63U2hQfjJB077AHrHfN2PkJu4DG86vSdtSzrZVDQmle331UxopLQvzDZ1mejfmSFbo6x1ZeTbo39PRpox4pzsfeUAM1Rf8H6y8OrdPZa7Gh6gRkiN2IcwdBnXI4-Q6HX5QqiVzr2O4zEnNsqMFfsFA3aO05hnp7EYRWHgS6EgaQjfBirCoyerBkjFJTXynl76Jj4fK3-3KY4tw5EHplxkgAih7a9QTxy8SbRee8kh7fwrIGEO6CtgkM9v0XL7jBPtNtGTpqBRzw"
    },
    "requestContext": {
        "authorizer": {
            "claims": {
                "sub": "231df9d7-0aab-4dsd-8389-d315d9daca7f",
                "email_verified": "true",
                "iss": "https://cognito-idp.us-west-2.amazonaws.com/us-west-2_an976DxVk",
                "custom:first_key": "false",
                "cognito:username": "231df9d7-0aab-4dsd-8389-d315d9daca7f",
                "origin_jti": "8131rlpo-5123-436b-b199-41315d9d4487",
                "aud": "r6315d9dt9sdls315d9d5h3cn",
                "event_id": "f3dsp9d8-213e-4648-8f80-f8315d9dc84e",
                "custom:name": "my_name",
                "token_use": "id",
                "auth_time": "1658148859",
                "exp": "Mon Jul 18 09:23:17 UTC 2022",
                "iat": "Mon Jul 18 08:23:17 UTC 2022",
                "jti": "982sdafe-97rs-996l-i899-k315d9d09n7n",
                "email": "jeff@amazon.com"
            }
        },
        "extendedRequestId": "dSiT_dLdJdad9oP=",
        "requestTime": "18/Jul/2022:08:23:27 +0000",
        "requestTimeEpoch": 1658132607750,
        "requestId": "387ss00s3-add0-62i9-l9s0-9a8dj8976dfa",
        "identity": {
            "cognitoIdentityPoolId": null,
            "accountId": null,
            "cognitoIdentityId": null,
            "caller": null,
            "sourceIp": "91.83.769.200",
            "principalOrgId": null,
            "accessKey": null,
            "cognitoAuthenticationType": null,
            "cognitoAuthenticationProvider": null,
            "userArn": null,
            "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0",
            "user": null
        },
        "domainName": "mskd8fpni2.execute-api.us-west-2.amazonaws.com",
        "apiId": "mskds98ni2"
    },
    "body": "{\"name\":\"my_name\"}",
    "isBase64Encoded": false
}

and the following fields being available in the context of the invocation:

{
    "callbackWaitsForEmptyEventLoop": true,
    "functionVersion": "$LATEST",
    "functionName": "hello-world-jsHelloWorldFunction-kTdLswTRrkdS",
    "memoryLimitInMB": "512",
    "logGroupName": "/aws/lambda/hello-world-jsHelloWorldFunction-kTdLswTRrkdS",
    "logStreamName": "2022/07/15/[$LATEST]95edi84719944bdi84a6cdi8451di849",
    "invokedFunctionArn": "arn:aws:lambda:us-west-2:598763214571:function:hello-world-jsHelloWorldFunction-kTdLswTRrkdS",
    "awsRequestId": "d8s57juq-3g39-49sk-8625-5849sk9be44I"
}

Notice the following things:

• The Cognito User's IdentityId is not available in either the event or the context
• Other information about the Cognito User is available in the event (email, sub, custom attributes, etc.)
• The request invocation time is available in the event (the time that the lambda function was invoked which is available in event.requestContext.requestTime and event.requestContext.requestTimeEpoch)

Note: Please leave a comment if you are having a hard time setting up an API-Gateway trigger with a Cognito User Pool Authorizer for your Lambda Function, if people are interested I will add instructions on how to accomplish this.

Direct invocation using a Cognito User's credentials and the AWS SDK for JavaScript v3

The IdentityId can be obtained in the following way:

exports.handler = async (event,context) => {
        var identity_ID =  context.identity.cognitoIdentityId
        console.log(identity_ID)
        // us-west-2:d393294b-ff23-43t6-d8s5-59876321457d

        const response = {
            statusCode: 200,
            headers: {
                "Access-Control-Allow-Headers": "*",
                "Access-Control-Allow-Origin": "*",
                "Access-Control-Allow-Methods" : "OPTIONS,POST,GET,PUT"
             }, 
             body:JSON.stringify(identity_ID)
        };
        return response;
}

Why?

Directly invoking a Lambda Function using the AWS SDK for Javascript v3 and a Cognito User's credentials will result in no additional information being available in the event of the invocation:

{
    "name": "my_name"
}

however, the IdentityId is available in the context of the invocation:

{
    "callbackWaitsForEmptyEventLoop": true,
    "functionVersion": "$LATEST",
    "functionName": "hello-world-jsHelloWorldFunction-kTdLswTRrkdS",
    "memoryLimitInMB": "512",
    "logGroupName": "/aws/lambda/hello-world-jsHelloWorldFunction-kTdLswTRrkdS",
    "logStreamName": "2022/07/15/[$LATEST]95edi84719944bdi84a6cdi8451di849",
    "identity": {
        "cognitoIdentityId": "us-west-2:d393294b-ff23-43t6-d8s5-59876321457d",
        "cognitoIdentityPoolId": "us-west-2:7y812k8a-1w26-8dk4-84iw-2kdi849sku72"
    },
    "invokedFunctionArn": "arn:aws:lambda:us-west-2:598763214571:function:hello-world-jsHelloWorldFunction-kTdLswTRrkdS",
    "awsRequestId": "d8s57juq-3g39-49sk-8625-5849sk9be44I"
}

Notice the following things:

• The Cognito User's IdentityId is available in context.identity.cognitoIdentityId
• Additional information about the Cognito User is not available in the event or the context (email, sub, custom attributes, etc.)
• The request invocation time is not available in either the event or context

Note: To directly invoke a Lambda Function using a Cognito User's credentials and the AWS SDK for JavaScript v3, you need to add a custom IAM Permission to the IAM Role assumed by authenticated Users in your Cognito User Pool. To do this:

1. Go to IAM -> Roles, and find the role for your user pool such as amplify-myapp-prod-12987-authRole
2. Click "Add permissions"
3. Click "Create inline policy"
4. Click "JSON"
5. Insert the following policy and replace the Function ARN with the ARN of your Lambda Function:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeFunctionUrl",
                "lambda:InvokeFunction"
            ],
            "Resource": [
                "arn:aws:lambda:*:598763214571:function:hello-world-jsHelloWorldFunction-kTdLswTRrkdS"
            ]
        }
    ]
}

6. Click "Review Policy"
7. Save the policy

Invocation methods that don't currently support authenticating users from a Cognito User Pool:

1. Invoking with caller credentials (this only works if you are using AWS_IAM authentication, not a Cognito User Pool Authorizer)
2. Invoking via a function URL (this only supports AWS_IAM authentication as well)

---

Answer 6

My observation is the following.

If you call the API Gateway with a signed Request where you actually provide the accesskey, secret and sessionToken which you can extract via (JS SDK):

AWS.config.credentials = new AWS.CognitoIdentityCredentials(...)
AWS.config.credentials.get(..)

And assumed that your lambda is called from API-Gateway via LAMBDA_PROXY and Authorizer AWS_IAM. You can only access user stuff in lambda with:

exports.create = function (event, context) {
   secdata = event.requestContext.identity.cognitoAuthenticationProvider;
}

Then you will get, apart from other stuff, the "sub" of the cognito UserPool User. So if you really want to know more about the user, it seems you need to ask AWS again via SDK call.

Answer 7

For a Python Lambda, invoked via Javascript AWS SDK / Cognito / Amplify...

https://docs.aws.amazon.com/lambda/latest/dg/python-context-object.html

context.identity.cognito_identity_id

It should look something like this:

{aws region}:{ GUID }

Assuming you are using an Identity Pool, this will return the Cognito Federated Identity, that can be used for fine grained access control. This is safer than relying on the Javascript payload containing the identity id.

The Cognito Identity Pool Auth Role will need to have Lambda:InvokeFunction policy, otherwise the user won't be able to invoke the function in the first place.

Edit: This works when calling the Lambda function DIRECTLY, not via API Gateway.

Edit2: The Cognito user is allowed to call the lambda because it is explicitly set in the IAM Cognito Auth role.

Answer 8

I was using Kotlin and my Lambda handler was

override fun handleRequest(event: APIGatewayProxyRequestEvent, context: Context): APIGatewayProxyResponseEvent 

But event.requestContext had no authorizer. The solution was to upgrade the dependency in build.gradle from com.amazonaws:aws-lambda-java-events:2.1.0 to com.amazonaws:aws-lambda-java-events:2.2.7. After that, I got the username as follows.

val claims = requestContext.authorizer["claims"] as Map<String, String>
println(claims["cognito:username"])
println(claims["email"])