title: How to access custom attributes from Cognito User Pools in IAM policy variables?
body: <p>I have a Cognito User Pool which contains users assigned to groups.</p>
  
  <p>Each group has its own role which gets assigned on login (through Federated Identities Authenticated users). This part works beautifully.</p>
  
  <p>So it's possible to create different access levels and groups to match these cases. I am using DynamoDB to store some user and organization related data. Each role can be fine tuned.</p>
  
  <p>Where the issue arises is in the need to have multiple tenants. I have added a custom attribute and restricted access to editing and updating this attribute based on the roles discussed above. For DynamoDB, in the IAM policies, I am able to restrict access to rows based on a hard coded organizational ID (which could be attached to each item).</p>
  
  <p>Like so "rd" being a hardcoded value for an organizational ID:</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "VisualEditor0",
          "Effect": "Allow",
          "Action": [
              "dynamodb:GetItem",
              "dynamodb:BatchGetItem",
              "dynamodb:PutItem",
              "dynamodb:UpdateItem",
              "dynamodb:DeleteItem"
          ],
          "Resource": [
              "arn:aws:dynamodb:{region}:{number}:table/*"
          ],
          "Condition": {
              "ForAnyValue:StringEquals": {
                  "dynamodb:LeadingKeys": [
                      "rd"
                  ]
              }
          }
      }
  ]
  </code></pre>
  
  <p>}</p>
  
  <p>However, I would like to be able to access an attribute related to the signed in user (not their unique ID but something they can have in common with others from their organization) to avoid hard coding. Like so:</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "VisualEditor0",
          "Effect": "Allow",
          "Action": [
              "dynamodb:GetItem",
              "dynamodb:BatchGetItem",
              "dynamodb:PutItem",
              "dynamodb:UpdateItem",
              "dynamodb:DeleteItem"
          ],
          "Resource": [
              "arn:aws:dynamodb:{regions}:{number}:table/*"
          ],
          "Condition": {
              "ForAnyValue:StringEquals": {
                  "dynamodb:LeadingKeys": [
                      "${cognito-idp.{region}.amazonaws.com/{poolID}:attr[custom:org_id]}"
                  ]
              }
          }
      }
  ]
  </code></pre>
  
  <p>}</p>
  
  <p>The error I get for this is: </p>
  
  <pre><code>AccessDeniedException: User: arn:aws:sts::{number}:assumed-role/{role_name}/CognitoIdentityCredentials is not authorized to perform: dynamodb:GetItem on resource: arn:aws:dynamodb:{region}:{number}:table/{table_name}
  </code></pre>
  
  <p>I have tested different configurations of this and so far through trial and error, the hard coded method has worked but all types of variables have failed. If there is a better way of achieving multi-tenancy, feel free to advise. However, if I can access variables directly from my User Pool it would be great.</p>
  
  <p>Does anyone know how this can be achieved (I have gone through so much documentation and tried a lot of combination of things already)?</p>
  
  <p><em>Also: "dynamodb:Query" doesn't seem to want to accept "dynamodb:LeadingKeys", but the documentation seems to say otherwise, so I have removed it from this example.</em></p>
  
  <p><em>I am authenticating and making request using the aws-sdk + cognito-identity-js, which is working properly and returning data when I relax permissions.</em></p>