I have a cognito user pool, configured with AWS::Cognito::UserPoolResourceServer with lists of scopes, all these scopes are enabled on UserPoolClient->AllowedOAuthScopes. When I go through UI authentication, the token contains a list of scopes
"scope": "aws.cognito.signin.user.admin labs-mymoney-bills-api/view labs-mymoney-bills-api/edit openid profile labs-mymoney-bills-api/pay email",
for testing purposes I use adminInitiateAuth to fetch a token, with following params
var authParams = {
AuthFlow: 'ADMIN_USER_PASSWORD_AUTH',
ClientId: 'myclientid',
UserPoolId: 'myuserpool',
AuthParameters: {
USERNAME: 'myuser',
PASSWORD: 'herpassword'
}
};
The result token's scope looks like that
"scope": "aws.cognito.signin.user.admin",
Obviously, when I try to authenticate with my API endpoint that has defined scope, it is always unauthorized.
Is it a bug, or I'm doing something wrong, or have unrealistic expectations?
Thanks