amazon-web-services - AWS-Cognito : How to assign user roles in the user pool?

Question

我有一个用户管理系统，我在其中使用 AWS-Cognito userPool 进行注册/登录过程。我需要为这些用户分配角色。
例如: super 管理员、推荐等。

super 管理员角色负责添加/删除/编辑用户。
有没有办法仅通过使用 userPool 功能来做到这一点？
此外，是否可以通过 AWS 控制台而不是通过 API 分配角色？

Answer 1

The super admin role is responsible for adding/deleting/editing the users. Is there any way to do this just by using userPool features ?

您可以 assign IAM roles to groups .例如，如果您创建一个 superadminrole您分配给 superadmingroup组，然后 super 管理员根据 Actions for Amazon Cognito User Pools 有相应的操作，例如 cognito-idp:AdminCreateUser , cognito-idp:AdminDeleteUser , cognito-idp:AdminAddUserToGroup , cognito-idp:ListUsers , cognito-idp:ListUsersInGroup等，然后，一个登录的 super 管理员就可以执行相应的用户任务了。另请阅读 Developers and administrators can perform the following tasks 的列表以查看可用的操作。

Also, is it possible to assign roles through AWS console and not through an API ?

是的，复制自 Viewing User Attributes AWS Cognito 开发人员指南中的部分(重点是我的):

From the Amazon Cognito home page in the AWS Management Console, choose Manage your user identities.

Choose your user pool from the Your User Pools page.

Choose User and Groups to view user information.

Choose a user name to show more information about an individual user. From this screen, you can perform any of the following actions:

1. Add user to group
2. Reset user password
3. Confirm user
4. Enable or disable MFA
5. Delete user