Update Cognito Identity Pool Auth Role
Last updated
Last updated
Our application allows users to upload, share, and view files. We will be using the AWS S3 to store and view files. To make sure our users can access their folders properly, we will have to first configure the S3 access permissions to logged-in users.
Go to the Identity Pool and select Edit identity pool from top right
Copy the Authenticated role and go to the IAM console
Search for the IAM role and select Attach policies
Select Create Policy option
Copy the below policy JSON and create the policy
Unauthenticated and Authenticated roles are very intuitive features. As an application developer, I would just need to assign proper permissions to these roles to make sure that my application users get correct access based on their status.
It is possible to configure a rule-based role assignment as well via Identity Pool. For example, you can create a rule that assigns a specific IAM role for users with a custom:dept custom attribute value of Sales. cust: prefix is required for custom attributes.
Now, create a new IAM policy that we can assign to the authenticated role that will allow our users to access the /public-files folder.
The above policy will grant read access to the public folder.
Make sure your files bucket has the correct CORS configuration. You can refer to the Introduction section to get the configurations.
Assign the above policy to the role and test the web application again.
