title: AWS Cognito and AWS S3 integration?
body: <p>Is it possible to restrict AWS S3 objects such that only users who authenticate via AWS Cognito gain access to the object? I haven't figured out a way to do this, but it seems obvious to me that this would be a use case.</p>
  
  <p>I want to host a website via AWS S3 and restrict some objects (my pages) so that if a user were to go them directly they'd get a permission denied error. If the user was authenticated via AWS Cognito tho the object should be available. </p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "Deny access to objects in the secured directory.",
              "Effect": "Deny",
              "Principal": "*",
              "Action": "s3:*",
              "Resource": "arn:aws:s3:::domain.com/secured/*"
          },
          {
              "Sid": "Only allowed authenticated users access to a specific bucket.",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::x:role/Cognito_Domain_IdP_Auth_Role"
              },
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::domain.com/secured/*"
          },
          {
              "Sid": "Read access for web hosting.",
              "Effect": "Allow",
              "Principal": "*",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::domain.com/*"
          }
      ]
  }
  </code></pre>