title: Cognito, API Gateway and Lambda assuming the identity of the cognito user
body: <p>I’m building a React app, using API Gateway, lambda and cognito (basically starting from the <a href="https://serverless-stack.com" rel="noreferrer">https://serverless-stack.com</a> tutorial). I would like to setup fine grained access control to my DynamoDb (i.e. through IAM policies that restrict access to DynamoDb tables based upon the logged-in user - like <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_dynamodb_rows.html" rel="noreferrer">https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_dynamodb_rows.html</a>)</p>
  
  <p>AFAIK, a lambda function assumes a service role, as defined in the serverless.yml file, that has in itself nothing to do with the AIM policy that is attached to the logged in cognito user. I know that using an aim_authorizer, I can get info on the logged in user.</p>
  
  <p>My question: is it possible to have the lambda do AWS calls on behalf of the given cognito user, thus honoring the IAM policies attached to that user? (a bit similar as to how the serverless-stack tutorial interacts with S3)</p>
  
  <p>All suggestions welcome.</p>