1

I am using AWS Cognito for user management. I want users of my application to store their data in DynamoDB. So I need user-scoped access (User A can write data and only read data added by User A, User B being able to only read data added by User B).

Docs suggest the ability to have row-level and column-level fine grain access: (https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html).

BUT I am not using IAM, I am using Congito users (want it scoped to each user, not a Role/Group). This doc suggests you can use Cognito ID: (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_dynamodb_items.html).

However, according to this StackOverflow question (How to use DynamoDB fine grained access control with Cognito User Pools?), it's not what I am expecting?

Does AWS support my use-case? Lot of docs but its not clear if my use-case is supported.

Jash Sayani
  • 11
  • 2
  • Related AWS RePost questions (apparently also by OP): https://repost.aws/questions/QUf_nqks8NQUiHik_4YQr03g/dynamo-db-fine-grain-control-scoped-to-cognito-user – Colm Bhandal Jul 12 '22 at 16:01
  • I recommend reading [this article](https://thenewstack.io/understanding-aws-cognito-user-and-identity-pools-for-serverless-apps/), which helps clarify the differences between User Pools and Identity pools. – Colm Bhandal Jul 12 '22 at 16:54

1 Answers1

1

You need to use Cognito identity pool. Cognito identity pool acts as an identity broker. When a Cognito user authenticates using the user pool, then Cognito provides JWT tokens. User can use ID token provided by Cognito user pool and Cognito identity pool can take the token and provide temporary IAM credentials.

I am familiar with a similar use case as of yours. In that use case, user who has written data to S3 can only modify/delete that data. In this case, you can create new S3 folders (prefixes) for each user's Identity ID (provided by Cognito identity pool) and that particular user can access data under that S3 folder only.

I am not much familiar with DynamoDB access control, hence not able provide the exact solution now. You can try a similar approach as the above one.

https://docs.aws.amazon.com/cognito/latest/developerguide/tutorial-create-identity-pool.html

Cloudy
  • 13
  • 4