Cognito Access Token "cognito:groups" missing

Question

I want to authenticate my API Gateway requests with Cognito.

For that i created custom scopes. API Gateway checks those scopes and proxies these requests to my Elastic Beanstalk API. This works fine.

But another part of my Authorization are groups. Based on a assigned group some actions have restricted Access. I need to use groups because i want to be able to add or remove those groups during user-lifecycle. The group will be checked in my Elastic Beanstalk API.

---

Problem
The documentation states that Access Tokens contain the cognito:groups claim. But a setup like in the Image below does not include this claim in my token.

The following decoded jwt will be produced after a login via hosted-UI. As you can see the claim is missing. ID tokens (with openid scope) will include this group. I am also sure that i've tested Cognito earlier with Amplify JS-SDK which included the group. But there i was unable to include my custom scopes.

{
  "sub": "xxxxxxxxxxxxxxxxxxxxxx",
  "token_use": "access",
  "scope": "api.example.com/item.read api.example.com/item.write",
  "auth_time": 1615325374,
  "iss": "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_xxxxxxx",
  "exp": 1615328974,
  "iat": 1615325374,
  "version": 2,
  "jti": "f37219a5-c8b0-411b-bdb3-ab7d9201b491",
  "client_id": "xxxxxxxxxxxxxxx",
  "username": "xxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Do I miss about a restriction or configuration issue? Why is the group missing inside my Access Tokens? Thanks for your help!

Answer 1

I had the same issue. The cognito:groups value appeared after I added the openid scope:

and the access token is still supplied, as per earlier comments.