title: Different access tokens for users using aws Cognito for authorisation
body: <p>I am trying to provide differential access to services behind an aws api-gateway, lets say simplistically split into 2 user groups user-a and user-b that each can access /routeA or /routeB but not the other.</p>
  <p>User Authentication is via Cognito User Pool with 2 user groups defined. Front End is React and Amplify.</p>
  <p>I am going round in circles with this having tried a few approaches. Running this decision tree <a href="https://theburningmonk.com/2020/06/how-to-choose-the-right-api-gateway-auth-method/" rel="nofollow noreferrer">select-auth-method</a> points to using Cognito AuthZ which is fine in itself as I am using Cognito for AuthN.</p>
  <p>So far none of the examples/tutorials/articles/videos have demonstrated how to block some users while enabling others. I have tried:</p>
  <p>Cognito User Pool Authorizer - identity token based but seems to just AuthZ any logged in user. I could possibly attach IAM Roles to the user groups ?</p>
  <p>Custom Lambda Authorizer - Works well on checking for the valid user-group in the Access Token and dynamically creating the required permissions but, some additional latency from a λ and no check that the access token is current. Starts to feel like I am writing code for a system that exists somewhere else?</p>
  <p>Cognito OAuth - Spent some time trying to understand this. So I create a Resource Server attached to the Cognito app client and create some custom scopes that I can then reference in the Api-g Authorizers. Fine, but how to I create two different access tokens for the users that have different scopes? So far my understanding seems to suggest that it is another binary AuthZ approach, but articles suggest (but don't demonstrate!) it is capable of granular permissions? I must be missing something.</p>
  <p>I also saw this <a href="https://stackoverflow.com/questions/42555924/different-levels-of-access-for-aws-cognito">2017 answer</a> but things may have moved on with better approaches?</p>
  <p>I am minded to go OAuth route as it seems more of an industry standard approach and promises much but need a bit of insight as to how to enable different access tokens for different users.</p>