title: AWS: Restrict Cognito Authorized User to specific Lambda Functions
body: <p>I'm working with AWS and I've the following setup: UserPool; API Gateway, Lambda Functions</p>
  
  <p>The api gateway is using a UserPool authorizer to protect the lambda functions. This is working so far. Now I want to restrict every lambda function to a specific group of users. Therefore I've created two user groups in the CognitoPool (<code>user</code> and <code>admin</code>) and I've assigned a specific role to each group with a policy. Afterwards I've created a user in the UserPool and added him to the <code>user</code> group. That user is still able to submit requests to each route/lambda function.</p>
  
  <p>How do I submit a request?</p>
  
  <ul>
  <li>Postman</li>
  <li>set <code>IdToken</code> (of the authenticated user) in the <code>Authorization</code> header</li>
  <li>without <code>Authorization</code> header the response is a 401 (as expected)</li>
  <li>with <code>Authorization</code> header every lambda function can be triggered (not expected)</li>
  </ul>
  
  <p>Configuration of the UserPool Groups:</p>
  
  <ul>
  <li><p>Group User:</p>
  
  <ul>
  <li>Arn: <code>Role ARN: arn:aws:iam::xxxxxx:role/User</code></li>
  <li><p>UserRole is specified as</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      "Action": [
        "lambda:InvokeFunction",
        "lambda:InvokeAsync"
      ],
     "Resource": [
       "arn:aws:lambda:region:xxxxxx:function:api-dev-getItems
      ],
      "Effect": "Allow"
    ]
  }
  </code></pre></li>
  </ul></li>
  <li><p>Group Admin:</p>
  
  <ul>
  <li>Arn: <code>Role ARN: arn:aws:iam::xxxxxx:role/Admin</code></li>
  <li><p>AdminRole is specified as</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        "Action": [
        "lambda:InvokeFunction",
        "lambda:InvokeAsync"
      ],
      "Resource": [
         "arn:aws:lambda:region:xxxxxx:function:api-dev-getItems
         "arn:aws:lambda:region:xxxxxx:function:api-dev-getUsers
      ],
      "Effect": "Allow"
    ]
  }
  </code></pre></li>
  </ul></li>
  </ul>
  
  <p>The payload of the id token also contains:
  <code>'cognito:roles': [ 'arn:aws:iam::xxxxxx:role/User' ]</code></p>