IdentityPoolRoleAttachment

Source: src/AWS/Cognito/IdentityPoolRoleAttachment.ts

Attaches the authenticated/unauthenticated IAM roles to an Amazon Cognito identity pool. A singleton child of the pool — one attachment manages the pool’s role configuration.

Attaching Roles

import * as Cognito from "alchemy/AWS/Cognito";

const identities = yield* Cognito.IdentityPool("Identities", {});
const role = yield* IAM.Role("AuthenticatedRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { Federated: "cognito-identity.amazonaws.com" },
        Action: "sts:AssumeRoleWithWebIdentity",
        Condition: {
          StringEquals: {
            "cognito-identity.amazonaws.com:aud": identities.identityPoolId,
          },
        },
      },
    ],
  },
});
yield* Cognito.IdentityPoolRoleAttachment("Roles", {
  identityPoolId: identities.identityPoolId,
  roles: { authenticated: role.roleArn },
});