AWS Cognito Identity pools - how are user roles retrieved from ID/UserPool tokens?

Question

1. With AWS Cognito users login to there service using User Pool Identity or through Web-ID provider like FB, Google etc. In return to successful authentication they r