title: Deleting cognito user & identity has no affect on user access
body: <p>I am trying to use AWS Cognito user pools with Cognito federation as auth for my APIs on api-gateway. I got the authentication &amp; authorization part (using roles) to work, but now stuck on how to revoke access. After login &amp; getting the federated identity, I deleted the identity from identity browser (console) &amp; deleted the user from cognito user pool. But that does not invalidate access using the earlier generated tokens, till they expire (which is a minimum of 1 hour).</p>
  
  <p>I also tried setting <strong><em>ServerSideTokenCheck</em></strong> to true, but that doesn't work either. The only way to "revoke" access seems to be <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_disable-perms.html#denying-access-to-credentials-by-issue-time" rel="nofollow noreferrer">this</a>. But this does not work for us as our use case assigns roles to a group. I cannot have groups of users lose access to revoke/deny access to one user.</p>
  
  <p>Is there anything I have missed to get this done? I cannot fathom an auth service which does not give me easy way to revoke access to user.</p>