Trying to figure out how to control access to specific routes on my API using Cognito groups but I'm not getting anywhere with the AWS docs. Anyone have any good recommendations on how to achieve this?

Hey @Geoff Seemueller, I haven’t done this, but might be worth looking into the User Pool JWT authorizer and Lambda authorizer.

Thanks @Frank - I'm going to give it a go

With the JWT authorizer, see if you can include the Cognito group info in the JWT token’s scope, and then see if you can have the authorizer grant/reject the request based on the scope. I haven’t done something like this, u might need to google along this line.

Got it working! Found an example of someone using a pretokenGeneration trigger to map the user's cognito groups to scopes. link Then secured the route by setting authorizationScopes on the ApiHttpRouteProps of the handlers in the API Stack.