title: AccessDeniedException when using Fine-Grained Access control for DynamoDb
body: <p>I have a lambda function behind API Gateway (Apollo Server to be precise) and I am accessing it via a react app by passing a JWT IdToken I am obtaining after logging in using Amplify Auth.</p>
  <p>However when I attempt to run this application I continually get:</p>
  <blockquote>
  <p>AccessDeniedException: User: arn:aws:sts::AWS Account ID:assumed-role/shop-app-xxx-XXX-CognitoAuthorizedRole-XXXXXXXXXX/CognitoIdentityCredentials is not authorized to perform: dynamodb:GetItem on resource: arn:aws:dynamodb:us-east-1:AWS Account ID:table/Shop&quot;</p>
  </blockquote>
  <p>It is the following condition on my Role Policy which is causing this (see below for full role/policy).  I don't know enough to understand is there something wrong with my policy or is there something wrong with the way I'm obtaining my credentials. Does the <code>sts:AssumeRoleWithWebIdentity</code> Action in my Role result in me no longer using the cognito identity to access the resource?</p>
  <pre><code>                Condition:
                      ForAllValues:StringEquals:
                              dynamodb:LeadingKeys:
                                  - &quot;${cognito-identity.amazonaws.com:sub}
  </code></pre>
  <pre><code>const identityToken = event.headers.Authorization;
  
  AWS.config.credentials = new AWS.CognitoIdentityCredentials({
        IdentityPoolId: `${process.env.IDENTITY_POOL_ID}`,
        Logins: {
          [`cognito-idp.${awsConfig.region}.amazonaws.com/${process.env.USER_POOL_ID}`]: identityToken
        }    
  });
  
  (AWS.config.credentials as AWS.CognitoIdentityCredentials).refresh(function(err){
        if(!err) {
          console.log(&quot;no error&quot;);
          let dynamoDbClient:AWS.DynamoDB.DocumentClient = new AWS.DynamoDB.DocumentClient();
          getShopModel(user,dynamoDbClient).shop().then((shop)=&gt;{console.log(shop)});
        } else {
          console.log(&quot;got an error!&quot;);
          console.log(err);
        }
  });
  </code></pre>
  <p>The following is my Authorized Role and the Mapping.  If I remove the LeadingKeys Condition from the inline Policy then everything works fine.  But of course I don't have fine grained control.</p>
  <pre><code>  CognitoAuthorizedRole:
      Type: &quot;AWS::IAM::Role&quot;
      Properties:
        AssumeRolePolicyDocument: 
          Version: &quot;2012-10-17&quot;
          Statement:
            - Effect: &quot;Allow&quot;
              Principal: 
                Federated: &quot;cognito-identity.amazonaws.com&quot;
              Action: 
                - &quot;sts:AssumeRoleWithWebIdentity&quot;
              Condition:
                StringEquals: 
                  &quot;cognito-identity.amazonaws.com:aud&quot;: !Ref ShopIdentityPool
                &quot;ForAnyValue:StringLike&quot;:
                  &quot;cognito-identity.amazonaws.com:amr&quot;: authenticated
        Policies:
          - PolicyName: &quot;CognitoAuthorizedPolicy&quot;
            PolicyDocument: 
              Version: &quot;2012-10-17&quot;
              Statement: 
                - Effect: &quot;Allow&quot;
                  Action:
                    - &quot;cognito-sync:*&quot;
                    - &quot;cognito-identity:*&quot;
                  Resource: &quot;*&quot;
                - Effect: &quot;Allow&quot;
                  Action:
                    - &quot;lambda:InvokeFunction&quot;
                  Resource: &quot;*&quot;
                - Effect: Allow
                  Action:
                    - 'dynamodb:GetItem'
                    - 'dynamodb:PutItem'
                    - 'dynamodb:Query'
                    - 'dynamodb:Scan'
                    - 'dynamodb:Delete*'
                    - 'dynamodb:Update*'
                  Resource: [
                    !Sub &quot;arn:aws:dynamodb:${AWS::Region}:*:table/${ShopTable}&quot;,
                    !Sub &quot;arn:aws:dynamodb:${AWS::Region}:*:table/${ShopTable}/index/*&quot;]
                  Condition:
                      ForAllValues:StringEquals:
                              dynamodb:LeadingKeys:
                                  - &quot;${cognito-identity.amazonaws.com:sub}&quot;
  
    ShopIdentityPoolRoleMapping:
      Type: &quot;AWS::Cognito::IdentityPoolRoleAttachment&quot;
      Properties:
        IdentityPoolId: !Ref ShopIdentityPool
        Roles:
          authenticated: !GetAtt CognitoAuthorizedRole.Arn
          unauthenticated: !GetAtt CognitoUnAuthorizedRole.Arn
  
  
  </code></pre>