title: How to switch IAM roles for AWS Cognito User belonging to multiple User Pool groups?
body: <p>I have a web application built with AWS Amplify and Cognito used for authentication/authorization. Cognito User Pools is the identity provider.  </p>
  
  <p>Users are grouped into Cognito User Pools groups based on what permissions they should have.  </p>
  
  <p>I want some users to be part of multiple groups (e.g. Admin users) which should have the sum of these 
  group's permissions. But since the user can only assume one role I need to be able to switch roles in the app.  </p>
  
  <p>I tried accomplishing this by using the <code>getCredentialsForIdentity</code>:  </p>
  
  <pre><code>  const cognito_identity = new AWS.CognitoIdentity({ apiVersion: '2014-06-30', region: 'eu-central-1' });
    var params = {
      IdentityId: 'some_identity',
      CustomRoleArn: 'arn:aws:iam::&lt;account_id&gt;:role/editors',
    };
    cognito_identity.getCredentialsForIdentity(params, function(err, data) {
      if (err) console.log(err, err.stack);
      else     console.log(data);
    });
  </code></pre>
  
  <p>When invoking the above code it fails with 
  <strong>NotAuthorizedException: Access to Identity '`some_identity' is forbidden.</strong>  </p>
  
  <p>What do I need to do to make it work?</p>