How to get AWSCredentials given a AWS Cognito access_token

问题

In an android app, I receive a JWT access_token from http://<domain>.auth.<region>.amazoncognito.com/login once the user is done authenticating to a Cognito User Pool. That User Pool is linked to a Cognito Identity Pool.

What API should I call with that access_token to get an AWSCredentials object.

The closest one I found would be AssumeRoleWithWebIdentity, but that is an STS API, and some of what I've read on the web seems to recommend developers not use STS directly but rely on Cognito.

Moreover, I do not expect the API I need to require specifying a role name. Cognito Identity Pools are already configured to give authenticated users a specific role. And AssumeRoleWithWebIdentity takes a role name as input to the API. Hence that does not look like right.

I've looked at Cognito Identity Pool API Reference, and can't find an API that takes access_token and return AWS credentials.

UPDATE: The following answer which uses GetCredentialsForIdentity throws ResourceNotFoundException saying it cannot find the specified IdentityId.

string access_token = ...
var jwtAccessToken = System.IdentityModel.Tokens.Jwt.JwtSecurityToken(access_token);

var client = new AmazonCognitoIdentityClient(new AnonymousAWSCredentials(),REGION);

var response = await client.GetCredentialsForIdentityAsync(new GetCredentialsForIdentityRequest
{
    IdentityId=String.Format("{0}:{1}", REGION, jwtAccessToken.id),
    Logins=new Dictionary<string,string> 
    { 
        {String.Format("cognito-idp.{0}.amazonaws.com/{1}", REGION, USER_POOL_ID),
         access_token}
    }
});

回答1:

After much investigation, I found the answer.

1- One needs an id_token not an access_token to authenticate to Cognito, as misleading as this might sound. AWS's documentation which says you ask for id_token when you need to have user attributes like name / email etc... and ask for an access_token when you don't need that information and just want to authenticate is wrong, or at the very least misleading.

2- And here's how you use an id-token to get AWS Credentials:

var credentials = CognitoAWSCredentials(<identity pool Id>, region);
credentials.AddLogin(
    "cognito-idp.<region>.amazonaws.com/<user_pool_id>",
    id_token); // the raw token

Note that you do not need AssumeRoleWithIdentity, or GetCredentialsWithIdentity, you do not even need a AmazonCognitoIdentityClient.

回答2:

To get the credentials you can use GetCredentialsForIdentity method by passing the JWT token. This method is implemented in AmazonCognitoIdentityClient class in the AWS Android SDK.

IAM Role should be defined in the Cognito Federated Identities. This limits the assuming role to be handled internally, by Cognito not allowing the mobile app to assume any other role than the one configured. In addition you shouldn't give this role IAM permission, allowing the Android SDK to assume different roles (Unless its a superuser kind of a user who is logging in).

来源：https://stackoverflow.com/questions/49722333/how-to-get-awscredentials-given-a-aws-cognito-access-token

标签

amazon-web-services

amazon-cognito

aws-cognito