title: How to allow downloading files from S3 only to AWS Cognito users?
body: <p>In my AWS project, I use Cognito to allow both authenticated and unauthenticated users to use my Android app. I also use S3 to store files that the users can download from the app.</p>
  
  <p>Here is the content of my S3 bucket:</p>
  
  <pre><code>myS3Bucket:
     - folderAll
     - folderUserGroup
  </code></pre>
  
  <p>In that bucket, <code>folderAll</code> contains files that can be downloaded by each user of my app, and <code>folderUserGroup</code> contains files that can only be downloaded by authenticated users that are in a specific Cognito user group.</p>
  
  <p>Neither the files of <code>folderAll</code> nor the files of <code>folderUserGroup</code> should be allowed to be downloaded outside of the app, for example using a web browser.</p>
  
  <p>I already configured a Cognito user pool and identity pool, with roles for both authenticated and unauthenticated users like, for example, the authenticated user role:</p>
  
  <pre><code>  MyIdentityPoolRoleAuthenticated:
      Type: AWS::IAM::Role
      Properties:
        RoleName: my-identity-pool-authenticated
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: 'Allow'
              Principal:
                Federated: 'cognito-identity.amazonaws.com'
              Action:
                - 'sts:AssumeRoleWithWebIdentity'
              Condition:
                StringEquals:
                  'cognito-identity.amazonaws.com:aud':
                    Ref: MyIdentityPool
                'ForAnyValue:StringLike':
                  'cognito-identity.amazonaws.com:amr': authenticated
        Policies:
          - PolicyName: 'MyIdentityPoolRoleAuthenticatedPolicy'
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: 'Allow'
                  Action:
                    - 'mobileanalytics:PutEvents'
                    - 'cognito-sync:*'
                    - 'cognito-identity:*'
                  Resource: '*'
                - Effect: "Allow"
                  Action:
                    - "s3:GetObject"
                  Resource: "arn:aws:s3:::myS3Bucket/*"
  </code></pre>
  
  <p>So I tried to follow <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/role-based-access-control.html" rel="nofollow noreferrer">this</a> or <a href="https://medium.com/@haydnjmorris/uploading-photos-to-aws-s3-getting-started-with-cognito-and-iam-c96ba5b5496d" rel="nofollow noreferrer">this</a>, but I don't understand how to configure the S3 and Cognito roles and policies to achieve my need.</p>
  
  <p>How can I configure my roles and policies to restrict files download only to my Cognito users?</p>
  
  <p>Thanks for your help.</p>