Api gateway used id token instead of access token to allow request to call lambda

Currently, it supports id token or access token from Userpool as validation method, but not both, in case you select Userpool as authorizer. It's also true, that you can use lambda authoriser to handle both tokens with customised code in the authorizer.

The way of using access token with Userpool Authorizer is stated in the following page:

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enable-cognito-user-pool.html

To configure a COGNITO_USER_POOLS authorizer on methods

• Point 4: To use an identity token, do the following: Details ...
• Point 5: To use an access token, do the following:
  • For Authorization Scopes, enter one or more full names of a scope that has been configured when the Amazon Cognito user pool was created. For example, following the example given in Create an Amazon Cognito user pool for a REST API, one of the scopes is https://my-petstore-api.example.com/cats.read.
  • At runtime, the method call succeeds if any scope that's specified on the method in this step matches a scope that's claimed in the incoming token. Otherwise, the call fails with a 401 Unauthorized response.
  • Choose Save.

In a nutshell, it requires to specified Authorization Scopes in APIGateway Authorizer to use access token.

When configuring an API Gateway with Cognito user pools as an authorizer, the token validation behavior depends on how you've set up the integration.

By default, API Gateway validates the token's claims, including the aud (audience) claim in ID tokens and the client_id claim in access tokens. When you leave the Token validation field empty, API Gateway will still perform these validations.

ID tokens are primarily designed for authentication and contain user information, while access tokens are designed for authorization with OAuth 2.0 scopes that specify what actions are permitted.

To make your API Gateway accept access tokens:

1. Ensure your access token contains the correct OAuth 2.0 scopes that match the API resources you're trying to access.

2. If you're using a Cognito User Pool authorizer directly, you may need to specify the expected scopes in your API configuration.

3. Consider using a Lambda authorizer instead, which gives you more flexibility. With a Lambda authorizer, you can:

• Extract the token from the Authorization header
• Validate the token yourself
• Make authorization decisions based on token claims, scopes, or other attributes
• Return an IAM policy that allows or denies access to specific API methods

4. If using a Lambda authorizer, you can handle both token types by examining the token_use claim (which will be "id" for ID tokens and "access" for access tokens) and applying appropriate validation logic.

The most common approach for API authorization is to use access tokens with appropriate scopes, as this follows OAuth 2.0 best practices where ID tokens are for authentication and access tokens are for authorization.
Sources
Accessing resources with API Gateway after sign-in - Amazon Cognito
Input to an API Gateway Lambda authorizer - Amazon API Gateway
Community | Using Verified Permissions with Cognito to control access to API endpoints

Thanks for your sharing. I will try it out