title: Lambda not assuming role in AWS serverless framework from Cognito User Pool. What am I doing wrong?
body: <p>I'm trying to create a admin API using api gateway, lambda and dynamoDB. I want only the logged in users in certain group be able to access lambda.</p>
  <p>I see that the lambda would not assume role of the cognito user  and access the dynamoDB. API only works if I attach the dynamoDB policy to the LambdaRole.</p>
  <p>Is there a way for this to work dynamically based on user groups. Do I need to add this assumeRole logic in the lambda handler itself ? Please help</p>
  <p>This is the <strong>ERROR</strong> I get when I git my API from postman with Authorization tokens</p>
  <pre><code>{
    &quot;message&quot;: &quot;User: arn:aws:sts::09723XXXXX357:assumed-role/tango-admin-lambda-role/tango-admin-service-dev-getActiveOrders is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:09723XXXXX357:table/dev-tango-service-tango-order-db&quot;,
    &quot;code&quot;: &quot;AccessDeniedException&quot;,
    &quot;time&quot;: &quot;2022-05-23T18:42:39.241Z&quot;,
    &quot;requestId&quot;: &quot;DDK7AS6SBO8D0U3KXXXXXXXX&quot;,
    &quot;statusCode&quot;: 400,
    &quot;retryable&quot;: false,
    &quot;retryDelay&quot;: 46.2351059972586
  }
  </code></pre>
  <p>Here is my serverless.yml file</p>
  <pre><code>service: tango-admin-service
  
  provider:
    name: aws
    runtime: nodejs14.x
    region: us-east-1
    environment:
      DYNAMODB_TABLE: ${opt:stage, self:provider.stage}-tango-service-tango-order-db
  # functions
  functions:
    hello:
      handler: src/handlers/hello.handler
      events:
        - http:
            path: hello
            method: get
  
    getActiveOrders:
      handler: src/handlers/getActiveOrders.handler
      role: TangoAdminLambdaRole # How can this role be assume from Congito ? It only works if I directly pass the Role with DynamoDB Policy
      events: # The events that trigger this function
        - http:
            path: get-active-orders
            method: post
            cors: true
            authorizer:
              type: COGNITO_USER_POOLS
              authorizerId:
                Ref: TangoAdminApiAuthorizer
  
  # Serverless plugins
  plugins:
    - serverless-plugin-typescript
    - serverless-offline
  
  resources:
    Resources:
      
      TangoAdminCognitoUserPool:
        Type: AWS::Cognito::UserPool
        Properties:
          UserPoolName: TangoAdmin
          
      TangoAdminCognitoUserPoolClient:
        Type: AWS::Cognito::UserPoolClient
        Properties:
          ClientName: TangoAdminWebApp
          GenerateSecret: false
          UserPoolId:
            Ref: &quot;TangoAdminCognitoUserPool&quot;
            
      TangoAdminGroup:
        Type: AWS::Cognito::UserPoolGroup
        Properties:
          GroupName: &quot;TangoAdmin&quot;
          Description: &quot;Admin group for Tango&quot;
          Precedence: 0
          RoleArn: !GetAtt CognitoAdminIAMRole.Arn
          UserPoolId:
            Ref: &quot;TangoAdminCognitoUserPool&quot;
            
      CognitoAdminIAMRole:
        Type: AWS::IAM::Role
        Properties:
          RoleName: &quot;tango-admin-role&quot;
          AssumeRolePolicyDocument:
            Version: &quot;2012-10-17&quot;
            Statement:
              - Effect: Allow
                Principal:
                  Federated:
                    - &quot;cognito-identity.amazonaws.com&quot;
                Action:
                  - &quot;sts:AssumeRoleWithWebIdentity&quot;
          Policies:
            - PolicyName: &quot;tango-admin-group-policy&quot;
              PolicyDocument:
                Version: &quot;2012-10-17&quot;
                Statement:
                  - Effect: Allow
                    Action:
                      - &quot;dynamodb:*&quot;
                    Resource:
                      - &quot;arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE}&quot;
  
      TangoAdminApiAuthorizer:
        Type: AWS::ApiGateway::Authorizer
        Properties:
          Name: TangoAdmin
          RestApiId:
            Ref: ApiGatewayRestApi
          Type: COGNITO_USER_POOLS
          ProviderARNs:
            - Fn::GetAtt: [ TangoAdminCognitoUserPool, Arn ]
          IdentitySource: method.request.header.Authorization
      
      TangoAdminLambdaRole:
        Type: AWS::IAM::Role
        Properties:
          RoleName: &quot;tango-admin-lambda-role&quot;
          AssumeRolePolicyDocument:
            Version: &quot;2012-10-17&quot;
            Statement:
              - Effect: Allow
                Principal:
                  Service: lambda.amazonaws.com
                Action:
                  - &quot;sts:AssumeRole&quot;
    Outputs:
      TangoAdminCognitoUserPoolId:
        Description: &quot;Tango Admin Cognito User Pool ID&quot;
        Value:
          Ref: &quot;TangoAdminCognitoUserPool&quot;
      TangoAdminCognitoUserPoolClientId:
        Description: &quot;Tango Admin Cognito User Pool Client ID&quot;
        Value:
          Ref: &quot;TangoAdminCognitoUserPoolClient&quot;
  </code></pre>