title: Istio request.auth.claims[cognito:groups] is not working
body: <pre><code>apiVersion: &quot;security.istio.io/v1beta1&quot;
  kind: &quot;RequestAuthentication&quot;
  metadata:
    name: &quot;jwt-example&quot;
    namespace: istio-system
  spec:
    selector:
      matchLabels:
        istio: ingressgateway
    jwtRules:
      - issuer: &quot;https://cognito-idp.ap-southeast-1.amazonaws.com/ap-southeast-xxxxx&quot;
        jwksUri: &quot;https://cognito-idp.ap-southeast-1.amazonaws.com/ap-southeast-xxxxx/.well-known/jwks.json&quot;
  </code></pre>
  <p>and</p>
  <pre><code>spec:
    selector:
      matchLabels:
        istio: ingressgateway
    action: ALLOW
    rules:
      - from:
          - source:
              notRequestPrincipals: [&quot;*&quot;]
        to:
          - operation:
              paths: [&quot;/api/v1/*&quot;]
        when:
          - key: request.auth.claims[cognito:groups]
            values: [&quot;testing&quot;]
  </code></pre>
  <p>I've tried to use above code snippets as to allow access to use <code>/api/v1/*</code> if JWT token is based on <code>testing</code> group of AWS Cognito. Unfortunately, it's now working as showing <code>RBAC: access denied</code>. Please let me know how can I fix it?</p>