title: AWS Cognito permissions to access S3 on Android
body: <p>I'm developing an Android app and keep having issues accessing S3 bucket "through" Cognito.
  I'm managing to connect to my cognito pool, with a username and a password of a specific user from my pool:</p>
  
  <pre><code>AWSMobileClient auth = AWSMobileClient.getInstance();
  auth.signIn("username", "password", new HashMap&lt;String, String&gt;());
  if (auth.isSignedIn()) {
          ActivityUtils.startActivity(this, MyActivity.class);
  }
  </code></pre>
  
  <p>My user in the pool is assigned to a group with attach S3 role:</p>
  
  <pre><code>Role ARN    arn:aws:iam::&lt;my account number&gt;:role/Cognito_S3_Full_Access
  </code></pre>
  
  <p>Which contains those permissions:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "s3:*",
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
  <p>When I'm trying to use the "AmazonS3Client" I created using the credentials from the "AWSMobileClient" I keep getting errors. I create it in this way:</p>
  
  <pre><code>AWSMobileClient awsMobileClient =AWSMobileClient.getInstance();
  AmazonS3Client s3Client = new AmazonS3Client(awsMobileClient);
  </code></pre>
  
  <p>And the <strong>error that I got is</strong>:</p>
  
  <pre><code>2019-05-20 17:56:21.645 27019-27019/com.mycomp.mypackage E/S3Uploader: Error upload file to S3 bucket : Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: 375C07384A904483)
  </code></pre>
  
  <p>When I'm creating the "AmazonS3Client" using <strong>HARD-CODED</strong> accessKey and secretKey of a new "IAM" user that I created and attach the same policy as above it working as expected.
  I'm using it this way:</p>
  
  <pre><code>BasicAWSCredentials credentials = new BasicAWSCredentials("myAccessKey_hsjgfhjsdg", "mySecretKey_asdhasjkdha");
  AmazonS3Client s3Client = new AmazonS3Client(credentials);
  </code></pre>
  
  <p>But I don't want to fill up my app with hard coded password, especially that I already manage to connect using the user input of his username and password</p>
  
  <ul>
  <li>Some notes: when I trying to get the secret key and access key after login with Cognito I can see that I get different token every login, so I guess this part is working.</li>
  </ul>
  
  <p>So my question is what am I doing wrong? </p>
  
  <p>How can I make the "AmazonS3Client" to use the session and role permission of the log-in user and his assigned group?</p>