title: How to use group-based permissions using AWS Amplify Auth library?
body: <h2>Goal</h2>
  <p>I'm trying to set up a Cognito group for admins, so they can call certain AWS services (specifically <code>cognito-idp:Admin*</code>) directly from the client. This will be faster than calling an API Gateway route to do the same via the back end.</p>
  <h2>What I've tried so far</h2>
  <p>I looked at the following docs:<br />
  <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-user-groups.html#assigning-iam-roles-to-groups" rel="nofollow noreferrer">https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-user-groups.html#assigning-iam-roles-to-groups</a><br />
  <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/role-based-access-control.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/cognito/latest/developerguide/role-based-access-control.html</a></p>
  <p>I added the Admin group, assigned my user to it, attached the following IAM role to the Admin group:</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Action&quot;: &quot;cognito-idp:Admin*&quot;,
              &quot;Resource&quot;: &quot;arn:aws:cognito-idp:us-east-1:xx:userpool/us-east-xx&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;
          }
      ]
  }
  </code></pre>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;Federated&quot;: &quot;cognito-identity.amazonaws.com&quot;
              },
              &quot;Action&quot;: &quot;sts:AssumeRoleWithWebIdentity&quot;,
              &quot;Condition&quot;: {
                  &quot;StringEquals&quot;: {
                      &quot;cognito-identity.amazonaws.com:aud&quot;: &quot;us-east-1:xx&quot;
                  }
              }
          }
      ]
  }
  </code></pre>
  <p>This doesn't work as expected. If I log in as an admin user into my app, I see permissions errors in the browser console and I can see it's using the wrong IAM role (<code>AuthIdentityPoolAuthRole</code>).</p>
  <h2>Theories</h2>
  <p>The above docs on role-based access say:</p>
  <blockquote>
  <p>Use the <code>GetCredentialsForIdentity</code> CustomRoleArn parameter if it is set and it matches a role in the cognito:roles claim. If this parameter doesn't match a role in cognito:roles, deny access.</p>
  </blockquote>
  <p>This might have something to do with it, but I don't see any way to get this low level with Amplify Auth. Also, IMO it wouldn't make sense to pass the IAM role ARN anyway. What would be the point of assigning the IAM role to the group, if the client can just specify any IAM role ARN for the user to assume?</p>