是否可以假定与Cognito用户池相关的Cognito组的Cognito用户链接到IAM角色iam-role1
?
我的配置:
Cognito用户池cognito-user-pool1
:
- Cognito用户
cognito-user1
属于cognito-group1
- Cognito组
cognito-group1
已分配给iam-role1
。
Cognito身份池cognito-identity-pool1
:
- 身份验证提供商:
cognito-user-pool1
- 已验证的角色 =
iam-role1
IAM:
- IAM角色
iam-role1
具有访问S3只读的策略
此代码允许我对Cognito用户池进行身份验证:
AmazonCognitoIdentityProviderClient provider = new AmazonCognitoIdentityProviderClient();
CognitoUserPool userPool = new CognitoUserPool("user-pool-id", "client-id", provider);
CognitoUser user = new CognitoUser("cognito-user1", "client-id", userPool, provider);
InitiateSrpAuthRequest authRequest = new InitiateSrpAuthRequest()
{
Password = "cognito-password1"
};
AuthFlowResponse authResponse = await user.StartWithSrpAuthAsync(authRequest);
接下来从链接到cognito用户池cognito-user-pool1
的cognito身份池cognito-identity-pool1
中获取凭据:
CognitoAWSCredentials credentials = user.GetCognitoAWSCredentials("identity-pool-arn", RegionEndpoint.USEast1);
using (var client = new AmazonS3Client(credentials))
...