For the most recent update on ongoing service disruptions affecting the AWS Middle East (UAE) Region (ME-CENTRAL-1), refer to the AWS Health Dashboard. For information on AWS Service migration, see How do I migrate my services to another region?
Using a Cognito custom attribute as a principal tag in an IAM policy condition is not working
1
Here's the setup:
- User Pool custom attribute:
custom:journalSubscription - User Pool app client: has read/write permission for the custom attribute
- Example user: has custom attribute
custom:journalSubscriptionset totrue - Identity Pool ABAC custom mapping: "Attribute name" of
custom:journalSubscription---maps to---> "Tag key for principal" ofjournalSubscription - IAM policy: uses a condition for "StringEquals" where "aws:PrincipalTag/journalSubscription" must equal "true"
Problem: the SDK call fails with this error:
User: <<AUTH_ROLE>> is not authorized to perform: dynamodb:GetItem on resource: <<ARN_FOR_MY_DynamoDB_TABLE>> because no identity-based policy allows the dynamodb:GetItem action
Note: the SDK call works fine with an IAM policy that uses a condition for a non-custom attribute such as "aws:PrincipalTag/email". It's just that for custom attributes, the call fails.
How can I make this work?
- Tags
- Amazon Cognito Federated IdentitiesTaggingAWS IAM Identity CenterAmazon Cognito User PoolsAWS IAM Access Analyzer
- Language
- English
asked 4 years ago1.5K views
2 Answers
- Newest
- Most votes
- Most comments
3
In the app client settings, for the OpenID Connect scopes, add profile. This allows the app client to retrieve "profile" attributes which seems to include custom attributes.
answered 4 years ago
Relevant content
- asked 2 years ago
- asked 3 years ago
open ID good