How to get access to private s3 bucket using cognito

Question

I have a cognito user pool which is connected to google as identity providers (so that I can log in with a gmail account). I also have a private bucket s3 with files (). How can I use my lambda function, using the token returned by Cognito (AcessToken, IdToken) to get access to my s3 bucket which is not public?

I just want to use my cognito to access my private files on s3.

Something like the Cognito Authorizer for lambda functions just for s3 bucket.

Answer 1

You can use Signed URLs to achieve this.

Basically, after your user successfully authenticated by Cognito, your Lambda function will generate s3 pre-signed url for object requested and reply it back.

Example from AWS Documentation

Also take a look at this AWS forum thread

Answer 2

The only way that i know to do this is give the role access to the cognito user

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_cognito-bucket.html