Create user groups

Create identity pool

Change role selection based on token of user

Create full access API permission for example Superadmin role

Create limited access API permission for example Standard Admin role

Create role to attach API Full Access permission

Add role to Cognito User Pool Superadmin Group

Change API Authorization to AWS_IAM

Get Cognito Identity Credentials

Users' identity pool IDs

Get Temporary credentials w/ CLI

Examples

Standard User request for resource their permissions allows

Superdamin request on resource #1

Standard Admin request for resource outside of their permissions

Superadmin request on resource #2

Test yourself with Postman's AWS Signature

Amazon recommends using Postman when their custom signature is required

Endpoint #1 (Should work for Standard Admin credentials)

https://flt5sd48q6.execute-api.us-west-2.amazonaws.com/test/get

Endpoint #2 (Should only work for Superadmin credentials)

https://flt5sd48q6.execute-api.us-west-2.amazonaws.com/test/testRolesPing

Standard credentials (Expires at 7:30 PM 2/20)

Access Key:ASIA36RI7H2PC6IXJRQQ

Secret Key:cRNyNDyHdZRay3ubrgMYWVYrncQHzSGZmXFPniOB

AWS Region: us-west-2

Session Token: AgoGb3JpZ2luEHYaCXVzLXdlc3QtMiKAAkMHcUWbawqIgcAxi6S7fSTeBb5q7NnRtGcJdHbdHmOrRwcfwCacJ2putk2g8irRsEbeoaKNDk9ss3xdpOnG8RDfoktIGhrpEIxiQnA/QBN4Xu/Y00ISiOuLTs8b1iJD0gNsrnYeYruy5d0OmkZeaUVn7VXT4rBZphI/AWqx6vQCH/lKQkMgDvLGWo8vvZch3FiW4ah5NuXIA4mb4sHkbz5rnQm/KKmYGowL4uZ334RSP1t9R/N0uqxlIOe5AiFTkvY18TCO6f/A4nGjXOK5+19KEqTLixGpKX+/CWgZ35S3YN1+WE2MAXidAzZF5SvyedBQZch4aRkG4lUonly9WVgqrwUInP//////////ARAAGgw4MjE0OTg0MjkwODYiDLlPf/rG5KYRWxAdIiqDBTt3BTphzK8CFcMZNzCjzvTnrHgmpk7HmPae1sS1eUMPRa/Rk6L4tAsGWBZI7U8qQxU6qZLDnJnqmsP8sQUM0bNl3n7Ndh5X8sQnx5miN/8Bevs5/SPOHhKS9TFnUm/T33CErTQzsAbn/CgC/0LtE7vf0/W2j0+ucv0vI3QT0kEIlU3i1JdTAx2DYKJ+0PDRrRynHoYCqZ0vulUYJ75SKz5EJlSERvKBBKX8HYBb6HwP13Ps6NUojpGrYXDQf4R7g6BV2Ya3hm2KuiwTdJEqFq5pnANMRDxg1M5W9/gmZ2+mtStjplAa1ds3b5ewSc2ColeLyhkhKNVVik9upGj7fN8BoNjijrQIsGXzPT+l8puYZrir1XEV4zemExLXA++i2n/Orb11x/6+w3D0DdKL1L5EhvFGRCZjKDYgIzu7wJcPCnSiuZZJYljOwrfO4NDrJCLOo8JS5gDaRYVfqcj4onLFNAuxvnw9+V8LpvOq6DGSOCIoUCLMwub6WTLZmU70RooVRJF5139CJTg/nRqwYXqH3s+AHJrTzlea9QiutLkoRWceZacoxiGhZZr/CF//MV3qFZ2eE9LXrKt9m1Yzb8gHrcsOVB5G1QoHdfl9qMsFhv/Us96Ej7EuG+9bMibiJfz3n/PX6vbSauR6OUR1M1JBq4Bp8wVgeB7G/5ja+ZVZ7dVlsM8YCNzu16zNVhtWKsyQz6q2BuT842c0tWAz0KMhFiy+yXXv1DxQ05ksn6VFpmcsCuBF79V88+KbtvMdziK/6e6hjIY+Z0pqbMYgSXtnwOzFApvkScW5Wj4bORmFNDqVIL6pckOaD1qktRpxAnmD3DUfOdQ2kGxdUEwYRZST51owuJq44wU=

Superadmin credentials (Expires at 7:30 PM 2/20)

Access Key:ASIA36RI7H2PKON2NVMD

Secret Key:P0DRn906wL/0lyKUBXjS8hedmo+LpIu8OftwALei

AWS Region: us-west-2

Session Token: AgoGb3JpZ2luEHYaCXVzLXdlc3QtMiKAAjV6gk0sLafT3KekpvRUo1Zf5SlnFUsCoy82Q9MxGtE9w+rV4lbMB/zEosL795uNUQUXihqVpWvFssp2QrnCRi9BGU1fEKzMWzSeEUenGUc4jT9sIoGjHg8IA/JBXmEjPGjkXz9UjV6c3im1NmHp/iOyQbq6gcvsUH3Gnd3eAknH+CuNCt6/EmDWIgT0/X2ns0ukexymp384XIuFfyz8JAmuSCIIeF5hAil9avwLKs/pkNcRducpUsIJJDDQCe6Tau1jCMEXrQ/i6ZMDS5P44Xn0ZsASB6idxQqaLnyX2owZ1lg+8cJNGu9CZqbJwqvfD0/3GaVXP1+Y715QAqllseMqrwUInP//////////ARAAGgw4MjE0OTg0MjkwODYiDFjvTZoNambFrNxz2iqDBSjQHr3QiGI3VaLrJ6IGMDTMvxVKqp5H9vRwnuJ2Ksn5aH0wYkAdMFyLSVqljdq8dhmBp7es7z4MtMUevAezmkasFhGmz2nphG2oqhXgEnWItwi6KhdEArV7KtO4rFCbRSBW1LcDITUnBvc2pACoR0H6+7PMgxfnnXmsSpcU5xEgHRi0BvI6AqG46nUGeLa6xM+1olGWvu+fIKS4d0a4biBbjPW3Nj9qdWz2pfrPVO3pkatsTkF35F54CYAN7lr3LkDc54CnVbxjplNW+l1vOFz68WKH+NB7V+bynWsCnevlSaMTy4AvCVLf3qW+eJQ2t8tvFA7TSy7FiG53yA+hAVM0XBbNPlDEI+HmvA6cr2dnTseCEMkNfTkF16fve41kUaVkTrHhiKdSIm1F0upUGCORovgWm0NjM+oFM3mSBBxgsGrMlElpgru8+JvlaRvLsnSH+T0KT90eASYzdNJ4/1nnQbXlWSWQiOjW2MYO++3TS6THioS+yETcEJmZE2GklzdoCz/rWhUKrUdnFBZhYBLzREqLPUVn+CUKVeLzJcSHKgNvjUoVkZ2VIU47hsIBRnwSVYM8r1mIm8ZIDW2aG7+7RtDnmLmjSQY/bM98IbgmOTf2rwvNZBdnkqFERF9BCOyFYu4/gk36dV81YmJ/0y1TkEsC8dLYM1BXEAb3ErBpaYqTJ+2XmxXJ5xIGi4o0CBgnePcWg4FBkPmFP26g6x/PRRgqVTEenn771uAtw3DgpZpeSOe8rqF0jkUktfYnbkWgc6PKjPho3lP5uO6TlEiPfG8Q+BEsxvCgjgA1PgA8Sz15STWEFmOtdZN1kfPDW3WzelB75d71R1tU2YwIiliuvtYwhpu44wU=