title: How does cognitoidentityserviceprovider.getUser() work?
body: <p>My questions is regarding AWS Cognito SDK.  My front-end authenticates the user with amplify /cognito and sends the token in the header to my backend.</p>
  <p>I have successfully used cognitoidentityserviceprovider.getUser() to get user attributes on my backend nodejs app, but without any permissions!</p>
  <p>I am using a restricted user with only S3 and SES permissions on my API, but I am just surprised, the getUser() call just decode the JWT token without any authorisation? and if so, can anyone decode all user attributes from my jwt token using aws-sdk?</p>
  <p>I also removed the API key entirely on the backend, just to see and it was still able get the user object successfully. Is this not a security risk?</p>
  <p>Code:</p>
  <pre><code>   const aws = require('aws-sdk');
     var provider =  new aws.CognitoIdentityServiceProvider();
     const user = await provider.getUser( {AccessToken: jwtToken}).promise();
     return user;
  </code></pre>