IdentityPoolAuth

Source: src/AWS/Cognito/IdentityPoolAuth.ts

Runtime binding for the public (token-based) Cognito identity pool flows — the credentials-vending data plane.

Bind this to an IdentityPool inside a function runtime to exchange user pool / social / OIDC tokens (or nothing, for guest access) for an identity ID and temporary AWS credentials. These operations are unauthenticated (Cognito does not evaluate IAM for them), so the binding grants no IAM policy — it injects the identity pool ID into getId.

Vending AWS Credentials

Guest (Unauthenticated) Credentials

const identity = yield* Cognito.IdentityPoolAuth(identityPool);

const { IdentityId } = yield* identity.getId();
const creds = yield* identity.getCredentialsForIdentity({
  IdentityId: IdentityId!,
});

Credentials for a User Pool Sign-In

const provider = `cognito-idp.${region}.amazonaws.com/${userPoolId}`;
const { IdentityId } = yield* identity.getId({
  Logins: { [provider]: idToken },
});
const creds = yield* identity.getCredentialsForIdentity({
  IdentityId: IdentityId!,
  Logins: { [provider]: idToken },
});