cognito fine grained access control and API gateway

Question

In api gateway, I have the following resource ARN:

arn:aws:execute-api:us-east-2:XXXXXXXXXXXXX:syx381ecq9/*/GET/members/*

which provides a link to get a list of members based on a class_id - /members/{id}
A user that is in a class can only see the list of members that belong into that class.

I have specified cognito user pool with the following IAM policy (assume that class1 is class_id)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cognito-identity:*",
                "mobileanalytics:PutEvents",
                "cognito-sync:*",
                "lambda:*",
                "execute-api:*"
            ],
            "Resource": [
                "arn:aws:execute-api:us-east-2:XXXXXXXXXXXXX:syx381ecq9/*/GET/members/class1"
            ]
        }
    ]
}

however, when used the link GET /members/class1, I get the following message:

Execution failed due to configuration error: API Gateway could not determine the callers credentials

I checked in cloudwatch, no log from lambda, therefore I think lambda was not executed. I continued trying with class2. This time the following message was shown:

User:arn:aws:sts::XXXXXXXXXXXX:assumed-role/Cognito-sample_client1/CognitoIdentityCredentials is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:us-east-2:********8469:syx381ecq9/sample/GET/inspectors/client2

I have checked in policy stimulate and everything worked fine with message Allowed

I have no idea why I could not call lambda? how can I fix this problem?

Thanks

Answer 1

OK, I found the answer. The above policy only allows calling lambda function for

arn:aws:execute-api:us-east-2:XXXXXXXXXXXXX:syx381ecq9/*/GET/members/class1

therefore, when cognito credential has passed, api will try to call lambda but unfortunately, the policy restricts that. In order to get through it, we need to separate it into another statement like the following:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cognito-identity:*",
                "mobileanalytics:PutEvents",
                "cognito-sync:*",
                "execute-api:*"
            ],
            "Resource": [
                "arn:aws:execute-api:us-east-2:XXXXXXXXXXXXX:syx381ecq9/*/GET/members/class1"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "lambda:*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

we can customized specific lambda's arn if required