Token received in lambda function returns Unauthorized in APIG
<p>These are my first steps in AWS in general and Cognito specifically. So please bear with me as I'm a bit confused by all the concepts and documention is not very easy to follow.</p>

<p>So I set up 3 lambda functions, one that creates a user, one that confirms a user and a last one that is supposed to authenticate the user.</p>

<p>The first 2 work fine, my user is created an confirmed. Now I'm stuck with the 3rd one which is supposed to return a token to be used in APIG, where I've set up a simple endpoint with my cognito authorizer.</p>

<p>Every token I get back returns Unauthorized when tested in the APIG/Authorizers/Cognito Pool Authorizers section.</p>

<p>My 'sign in' code is the following:</p>

<pre><code>const AWS = require('aws-sdk');

exports.handler = (event, context, callback) =&gt; {
  AWS.config.apiVersions = {
    cognitoidentityserviceprovider: '2016-04-18'
  };
  AWS.config.region = 'us-east-1'; // Region
  /*AWS.config.credentials = new AWS.CognitoIdentityCredentials({
    IdentityPoolId: 'MY_IDENTITY_POOL_ID',
  });*/

  var identityId = null;
  var params = {
    IdentityPoolId: 'MY_IDENTITY_POOL_ID',
    IdentityId: identityId,
    Logins: {
        'login.auth.MYPROJECT': 'MY_USERNAME'
    },
    TokenDuration: 86400
  };

  var cognito = new AWS.CognitoIdentity({
    region: AWS.config.region
  });

  cognito.getOpenIdTokenForDeveloperIdentity(params, function(err, data) {
    if (err) {
        return callback(err);
    }
    else {
        /*AWS.config.credentials = new AWS.CognitoIdentityCredentials({
            IdentityPoolId: params.IdentityPoolId
        });*/

        AWS.config.credentials.get(function(){
            // Credentials will be available when this function is called.
            var accessKeyId = AWS.config.credentials.accessKeyId;
            var secretAccessKey = AWS.config.credentials.secretAccessKey;
            var sessionToken = AWS.config.credentials.sessionToken;

            callback(null, {
                identityId: data.IdentityId, 
                token: data.Token,
                accessKeyId: accessKeyId,
                secretAccessKey: secretAccessKey,
                sessionToken: sessionToken
            });
        });
      }
  });
}
</code></pre>

<p>Both token and sessionToken return Unauthorized. Can someone tell me what is missing here?</p>

<p>Much appreciated.</p>

<p><strong>EDIT 2016-11-15</strong></p>

<p>The 'register' lambda code:</p>

<pre><code>const AWS = require('aws-sdk');

exports.handler = (event, context, callback) =&gt; {
    AWS.config.region = 'us-east-1'; // Region
    AWS.config.credentials = new AWS.CognitoIdentityCredentials({
        IdentityPoolId: 'MY_IDENTITY_POOL_ID',    
    });

    var poolData = { 
        UserPoolId : 'MY_USER_POOL_ID',
        ClientId : 'MY_CLIENT_ID'
    };

    var userPool = new AWS.CognitoIdentityServiceProvider(poolData);
    var email = "myemail+" + Math.floor(Math.random() * (100 - 1) + 1) + "@example.com";
    var params = {
      ClientId: 'MY_CLIENT_ID', 
      Password: '1234567890', 
      Username: 'testaccount' + Math.floor(Math.random() * (100 - 1) + 1), 
      UserAttributes: [
        {
          Name: 'email', 
          Value: email
        }
      ]
    };

    userPool.signUp(params, function(err, result){
        if (err) {
            console.log(err)
            return;
        }

        callback(null, {
            "message": "Hello from Lambda",
            "data": result
        });
    });
};
</code></pre>

<p>My 'activate' lambda code is the following:</p>

<pre><code>const AWS = require('aws-sdk');

exports.handler = (event, context, callback) =&gt; {
    AWS.config.region = 'us-east-1'; // Region
    AWS.config.credentials = new AWS.CognitoIdentityCredentials({
        IdentityPoolId: 'MY_IDENTITY_POOL_ID',
    });

    var poolData = { 
      UserPoolId : 'MY_USER_POOL_ID',
      ClientId : 'MY_CLIENT_ID'
    };

    var userPool = new AWS.CognitoIdentityServiceProvider(poolData);
    var email = "email_address@example.com";
    var params = {
      ClientId: 'MY_CLIENT_ID', 
      Username: 'test_username', 
      ForceAliasCreation: false,
      ConfirmationCode: '927000'
    };


    userPool.confirmSignUp(params, function(err, result){
        if (err) {
            console.log(err)
            return;
        }

        callback(null, {
            "message": "Hello from Lambda",
            "data": result
        });
    });
};
</code></pre>

<p>In APIG, I created a <strong>Cognito User Pool Authorizer</strong>, selected my user pool, gave it a name, and set the identity token source to <strong>'method.request.header.Authorization'</strong>.</p>

<p>In my APIG resource under the <strong>Method Request</strong>, I've set Authorization to my Cognito User Pool Authorizer. Additionally, <strong>API Key Required</strong> is set to <em>true</em> and I've a couple of keys I was testing with and that caused no issues.</p>

<p>I hope this covers everything.</p>