cognito fine grained access control and API gateway
<p>In api gateway, I have the following resource ARN: </p>

<pre><code>arn:aws:execute-api:us-east-2:XXXXXXXXXXXXX:syx381ecq9/*/GET/members/*
</code></pre>

<p>which provides a link to get a list of members based on a class_id - <strong>/members/{id}</strong><br>
A user that is in a class can only see the list of members that belong into that class.</p>

<p>I have specified cognito user pool with the following IAM policy (assume that class1 is class_id)</p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cognito-identity:*",
                "mobileanalytics:PutEvents",
                "cognito-sync:*",
                "lambda:*",
                "execute-api:*"
            ],
            "Resource": [
                "arn:aws:execute-api:us-east-2:XXXXXXXXXXXXX:syx381ecq9/*/GET/members/class1"
            ]
        }
    ]
}
</code></pre>

<p>however, when used the link <strong>GET /members/class1</strong>, I get the following message:</p>

<pre><code>Execution failed due to configuration error: API Gateway could not determine the callers credentials
</code></pre>

<p>I checked in cloudwatch, no log from lambda, therefore I think lambda was not executed.
I continued trying with class2. This time the following message was shown:</p>

<p><code>User:arn:aws:sts::XXXXXXXXXXXX:assumed-role/Cognito-sample_client1/CognitoIdentityCredentials is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:us-east-2:********8469:syx381ecq9/sample/GET/inspectors/client2</code>
<br><br></p>

<p>I have checked in <a href="https://policysim.aws.amazon.com/home/index.jsp" rel="nofollow noreferrer">policy stimulate</a> and everything worked fine with message <strong>Allowed</strong>
<br><br>
I have no idea why I could not call lambda? how can I fix this problem?</p>

<p>Thanks</p>