Trying to get a better understanding of how I shou...
# guide
m
Trying to get a better understanding of how I should be setting up my userIds in my lambda functions https://serverless-stack.com/chapters/secure-our-serverless-apis.html https://serverless-stack.com/chapters/cognito-user-pool-vs-identity-pool.html https://serverless-stack.com/chapters/mapping-cognito-identity-id-and-user-pool-id.html The guide uses the federated identity vs the User pool userid, but links to ways of using the user pool instead if that is what you want. One question I have is, what would be a driving decision on using one vs the other? I know the guide tries to break it down, but it’s not exactly clear on why you would decide on one vs the other aside from “if that is what you want”. So, why would I want to use the Userpool user id vs the federated identity is my question
f
Hey @mathewgries, good point. Let me share 1 example. If you want the users to be able to upload files to an S3 bucket directly, you’d grant the S3 upload permission to users the identity pool.
ie.
Copy code
action: s3:*
resource: arn:aws:s3:::bucket_name/*
This would allow the user to upload/remove ANY files in the S3 bucket.
Now, if you want a user to be able to upload/remove ONLY his files, you want to change the permission to:
Copy code
action: s3:*
resource: arn:aws:s3:::bucket_name/{federated identity}/*
afaik, IAM only knows about the federated identity
And now in your code if you want to correlate which S3 file belong to which user, it’s easier if you are using the federated identity as the user’s id
Let me know if that makes sense