How to get AWSCredentials given a AWS Cognito access_token

Question 1

In an android app, I receive a JWT access_token from http://<domain>.auth.<region>.amazoncognito.com/login once the user is done authenticating to a Cognito User Pool. That User Pool is linked to a Cognito Identity Pool.

What API should I call with that access_token to get an AWSCredentials object.

The closest one I found would be AssumeRoleWithWebIdentity, but that is an STS API, and some of what I’ve read on the web seems to recommend developers not use STS directly but rely on Cognito.

Moreover, I do not expect the API I need to require specifying a role name. Cognito Identity Pools are already configured to give authenticated users a specific role. And AssumeRoleWithWebIdentity takes a role name as input to the API. Hence that does not look like right.

I’ve looked at Cognito Identity Pool API Reference, and can’t find an API that takes access_token and return AWS credentials.

UPDATE:
The following answer which uses GetCredentialsForIdentity throws ResourceNotFoundException saying it cannot find the specified IdentityId.

string access_token = ...
var jwtAccessToken = System.IdentityModel.Tokens.Jwt.JwtSecurityToken(access_token);

var client = new AmazonCognitoIdentityClient(new AnonymousAWSCredentials(),REGION);

var response = await client.GetCredentialsForIdentityAsync(new GetCredentialsForIdentityRequest
{
    IdentityId=String.Format("{0}:{1}", REGION, jwtAccessToken.id),
    Logins=new Dictionary<string,string> 
    { 
        {String.Format("cognito-idp.{0}.amazonaws.com/{1}", REGION, USER_POOL_ID),
         access_token}
    }
});

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

string access_token = ...

var jwtAccessToken = System.IdentityModel.Tokens.Jwt.JwtSecurityToken(access_token);

var client = new AmazonCognitoIdentityClient(new AnonymousAWSCredentials(),REGION);

var response = await client.GetCredentialsForIdentityAsync(new GetCredentialsForIdentityRequest

{

IdentityId=String.Format("{0}:{1}", REGION, jwtAccessToken.id),

Logins=new Dictionary

{

{String.Format("cognito-idp.{0}.amazonaws.com/{1}", REGION, USER_POOL_ID),

access_token}

}

});

Question 2

After much investigation, I found the answer.

1- One needs an id_token not an access_token to authenticate to Cognito, as misleading as this might sound. AWS’s documentation which says you ask for id_token when you need to have user attributes like name / email etc… and ask for an access_token when you don’t need that information and just want to authenticate is wrong, or at the very least misleading.

2- And here’s how you use an id-token to get AWS Credentials:

var credentials = CognitoAWSCredentials(<identity pool Id>, region);
credentials.AddLogin(
    "cognito-idp.<region>.amazonaws.com/<user_pool_id>",
    id_token); // the raw token

1

2

3

4

5

var credentials = CognitoAWSCredentials(, region);

credentials.AddLogin(

"cognito-idp..amazonaws.com/",

id_token); // the raw token

Note that you do not need AssumeRoleWithIdentity, or GetCredentialsWithIdentity, you do not even need a AmazonCognitoIdentityClient.

How to get AWSCredentials given a AWS Cognito access_token

Question:

Answer:

Leave a Reply Cancel reply