title: AWS Cognito NotAuthorizedException "Invalid Access Token" error after authenticated login
body: <p>I have an AWS Cognito user pool/identity pool set up to authorize a Lambda function behind API-gateway.  My lambda is using the AWS SDK for Node.  The login process works fine.  In my function, I have an <code>CognitoIdentityServiceProvider</code> object that I'm using to call the <code>getUser</code> function.  The Access Key I'm giving the function is coming from the lambda variable <code>event.requestContext.identity.accessKey</code>.  However, the function call fails with the following error viewable through my Cloud Watch logs:</p>
  
  <pre><code>{
    "message": "Invalid Access Token",
    "code": "NotAuthorizedException",
    "time": "2019-08-03T20:34:50.511Z",
    "requestId": ...,
    "statusCode": 400,
    "retryable": false,
    "retryDelay": 36.048605458111794
  }
  </code></pre>
  
  <p>How is the token that is given to me in the authenticated request invalid?  I'm not even sure how to debug this, or what problems I should be looking for.  </p>
  
  <p>An example of how I am trying to make the call in my lamdba handler:</p>
  
  <pre><code>var AWS = require('aws-sdk');
  AWS.config.region = "us-west-2";
  let poolData = {
    UserPoolId: MY_POOL_ID,
    ClientId: MY_CLIENT_ID
  };
  const cognito = new AWS.CognitoIdentityServiceProvider(poolData);
  
  export async function myHandler(event, context, cb) {
    var params = {
      AccessToken: event.requestContext.identity.accessKey
    };
    cognito.getUser(params, (err, user) =&gt; {
      if (err) {
        console.log(JSON.stringify(err));
      }
      let response = {
        statusCode: 200,
        headers: {
          "Access-Control-Allow-Origin": "*",
          "Access-Control-Allow-Credentials": true,
        },
        body: { ... }
      };
      return cb(null, response);
    });
  }
  
  </code></pre>
  
  <p>I can test this API call from a React UI using AWS Amplify or a CLI test that both produce the same results in the backend.  So I don't think it's necessarily how the function is being invoked.  This is the method I use for CLI testing that will log in a user to the User Pool and make an API request on their behalf:</p>
  
  <pre><code>npx aws-api-gateway-cli-test \
  --username='my-test-user@domain.com' \
  --password='password' \
  --user-pool-id='us-west-2_000000000' \
  --app-client-id='00000000000000000000000' \
  --cognito-region='us-west-2' \
  --identity-pool-id='us-west-2:000000000-0000-0000-0000-000000000000' \
  --invoke-url='https://00000000000.execute-api.us-west-2.amazonaws.com/dev' \
  --api-gateway-region='us-west-2' \
  --path-template='/myHandler' \
  --method='GET'
  </code></pre>
  
  <p>The Access Token that is being passed from the API invocation has the "ASIA" prefix instead of the "AKIA" prefix if that is relevant here.  I'm not sure what other info to include about my User Pool or anything else, so if that's relevant to the solution, I would be happy to provide it.</p>