title: How do I find out what is actually set to "${ ... }" in AWS IAM policy?
body: <p>I'm trying to limit access to items in Dynamo DB tables based on Cognito User Pool using Lambda IAM role policy.</p>
  <p>In the process, I'm struggling to find what is actually set to &quot;${cognito-identity.amazonaws.com:aud}&quot; in the Lambda IAM policy below.</p>
  <pre><code> {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;dynamodb:Scan&quot;,
                  &quot;dynamodb:Query&quot;,
                  &quot;dynamodb:GetItem&quot;,
                  &quot;dynamodb:PutItem&quot;,
                  &quot;dynamodb:UpdateItem&quot;,
                  &quot;dynamodb:DeleteItem&quot;,
                  &quot;dynamodb:DescribeTable&quot;
              ],
              &quot;Condition&quot;: {
                  &quot;ForAllValues:StringEquals&quot;: {
                      &quot;dynamodb:LeadingKeys&quot;: &quot;${cognito-identity.amazonaws.com:aud}&quot;
                  }
              },
              &quot;Resource&quot;: &quot;arn:aws:dynamodb:ap-southeast-2:*:*&quot;
          }
  </code></pre>
  <p>I'm assuming it is either Application Client ID or Identity Pool ID like &quot;ap-southeast-2:xxxxxxxx-aaaa-bbbb-cccc-123456789012&quot;, but is there a way to output what is actually set to &quot;${cognito-identity.amazonaws.com:aud}&quot; on runtime to confirm?</p>
  <p>I am relatively new to AWS.</p>
  <p><strong>Updated - Additional Information</strong></p>
  <p>Just before calling the Lambda via API Gateway, I can see something like &quot;xxxxxxxxnv0ff03e9joqh3om3h&quot; (my App Client ID) using below:</p>
  <pre><code>const session = await Auth.currentSession();
  alert(session.idToken.payload.aud); //something like &quot;xxxxxxxxnv0ff03e9joqh3om3h&quot;
  </code></pre>
  <p>However, I get AccessDeniedException in Lambda DynamoDB query with the App Client ID.</p>
  <pre><code>ExpressionAttributeValues: {
    &quot;:partitionkey&quot;: &quot;xxxxxxxxnv0ff03e9joqh3om3h&quot;,
  },
  </code></pre>
  <p>I can avoid AccessDeniedException error by changing the IAM Policy to:</p>
  <pre><code>&quot;Condition&quot;: {
                  &quot;ForAllValues:StringEquals&quot;: {
                      &quot;dynamodb:LeadingKeys&quot;: &quot;123abc&quot;
                  }
              },
  </code></pre>
  <p>and my Lambda DynamoDB query to:</p>
  <pre><code>ExpressionAttributeValues: {
    &quot;:partitionkey&quot;: &quot;123abc&quot;,
  },
  </code></pre>
  <p>I've tried Cognito Identity Pool ID too, but no luck.</p>