title: How to restrict AWS Cognito users from taking certain actions?
body: <p>Help is required in the following problem we're facing </p>
  
  <p>Any tip would be much appreciated!</p>
  
  <h1>Details and environment:</h1>
  
  <ol>
  <li>A <strong><em>multi-tenant</em></strong> application that aims to provide a dedicated tenant per customer (organization), in order to achieve full separation.</li>
  <li><strong><em>AWS Cognito user pool</em></strong> as my users' datastore and authentication provider.</li>
  <li>an "AWS Cognito <strong><em>user pool" per customer</em></strong> (org).</li>
  <li><strong><em>Role</em></strong> management - based on the built-in <strong><em>user pool groups</em></strong>. Group per role and the server-side verifies that a user's access token includes a group name in it's embedded group's list.</li>
  </ol>
  
  <p>So far so good and everything is working as expected, using AWS Amplify's SDK, for the client side's implementation. Amplify performs well and allows me to do whatever I want. The server verifies group belonging etc.</p>
  
  <h1>The problem:</h1>
  
  <p>I want to restrict non-admin users (that doesn't belong to the "admin" group) from performing certain Cognito actions via Amplify.
  2 Examples: </p>
  
  <ol>
  <li>I want to disable non-admin users' ability to modify a specific attribute's value, via Amplify.</li>
  <li>I want to disable non-admin users' ability to modify MFA settings for themselves, via Amplify.</li>
  </ol>
  
  <p>The actual problem started when I wanted administrators to be able to set MFA (enable/disable) for other users, but in Cognito (as I understand it) only a user can set his own MFA settings.</p>
  
  <h1>What I saw and already tried:</h1>
  
  <ol>
  <li>Set read/write permissions for user attributes. So the specific attribute I want to protect is modifiable only via API calls with developer credentials. That way, admins can call my server to ask for attribute modification. The server verifies the role by a group belonging according to the access token and calls Cognito API. The problem with that solution is that it covers only the attribute modification scenario.</li>
  <li>Create an AWS Cognito identity pool for each of the user pools. For every group in every user pool, create an AWS IAM role with a policy that would restrict or allow the wanted behavior. The could actually work. The problem with that solution is that it feels like a super-duper overkill, plus it requires me to create an extra identity pool and an IAM role for each user pool. It means that every new customer that joins the service, would require (1) user pool, (2) Cognito client application, (3) identity pool and (4) IAM Role (instead of just a user pool and Cognito client app). <a href="https://aws.amazon.com/blogs/mobile/building-fine-grained-authorization-using-amazon-cognito-user-pools-groups/" rel="noreferrer">Essentially, implementing this solution.</a></li>
  </ol>
  
  <h1>The real question:</h1>
  
  <p><strong><em>Can I restrict users in a certain group from performing actions on themselves, such as disabling the MFA (even that the user-pool's MFA is set to "Optional")?</em></strong></p>
  
  <p>Thank you all so much! any help would be appreciated! </p>