title: AWS CLI: Get user details from Cognito Identities
body: <p>Using the AWS CLI, how to get user details (username, e-mail) from Cognito Identities?</p>
  <p>This question relates to <a href="https://stackoverflow.com/a/55436168/1692112">https://stackoverflow.com/a/55436168/1692112</a>, which no longer seems to be working in 2021.
  The problem is, the <code>sub</code> attribute in the User Pool no longer matches the <code>IdentityId</code> in the Identity Pool.</p>
  <p>List of users in the User Pool:</p>
  <pre><code>$ aws cognito-idp list-users --user-pool-id XX-XXXXX-X_XXXXXXXXX
  
  {
      &quot;Users&quot;: [
          {
              &quot;Username&quot;: &quot;my.username.yay&quot;,
              &quot;Attributes&quot;: [
                  {
                      &quot;Name&quot;: &quot;sub&quot;,
                      &quot;Value&quot;: &quot;XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX&quot;
                  },
                  {
                      &quot;Name&quot;: &quot;email_verified&quot;,
                      &quot;Value&quot;: &quot;true&quot;
                  },
                  {
                      &quot;Name&quot;: &quot;email&quot;,
                      &quot;Value&quot;: &quot;my.username.yay@my.company.yay&quot;
                  }
              ],
              &quot;UserCreateDate&quot;: 1612361296.687,
              &quot;UserLastModifiedDate&quot;: 1612361331.99,
              &quot;Enabled&quot;: true,
              &quot;UserStatus&quot;: &quot;CONFIRMED&quot;
          }
      ]
  }
  </code></pre>
  <p>List of identities in the Identity Pool:</p>
  <pre><code>$ aws cognito-identity list-identities --identity-pool-id XX-XXXXXXXX-X:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX --max-results 50
  
  {
      &quot;IdentityPoolId&quot;: &quot;XX-XXXXX-X:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX&quot;,
      &quot;Identities&quot;: [
          {
              &quot;IdentityId&quot;: &quot;XX-XXXXXXX-X:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX&quot;,
              &quot;Logins&quot;: [
                  &quot;cognito-idp.XX-XXXXXXX-X.amazonaws.com/XX-XXXXXXX-X_XXXXXXXXX&quot;
              ],
              &quot;CreationDate&quot;: 1612795279.758,
              &quot;LastModifiedDate&quot;: 1612795279.771
          }
      ]
  }
  </code></pre>
  <p>I had been sort of hoping that the list of <code>Logins</code> would somehow mention the username or <code>sub</code>, but it just references the whole User Pool.</p>
  <p>Theoretically, it might be possible to use AWS Lambda and AWS Cognito Triggers to connect the two pools and store the IDs somewhere. However, I would assume that AWS Cognito already knows the connection between the two pools and that there's a simple command for the job.</p>
  <p>Edit: It appears that even by the time the last Cognito trigger <code>Pre Token Generation</code> is invoked, the identity does not exist yet. Moreover, the <code>event</code> structure does not reference the identity anywhere. Thus, AWS Lambda and Cognito Triggers would not provide a workaround to the AWS CLI, either.</p>
  <p>Any suggestions?</p>