title: AWS Cognito and AWS Api Gateway authorizations of users application
body: <p>I am using AWS Cognito for authentication related to my application. Because I am also using AWS Api Gateway to consume Lambdas in my application, I need to set security levels on the Gateway.</p>
  
  <p>In my application there will be many users, and in turn, there will be different roles (such as admin, marketing, management, etc). It should be noted that these users are application users, but not AWS IAM users.</p>
  
  <p>I created several groups of AWS Cognito users, and in turn, I have several users in those groups. For example, users of the admin group can enter any exposed api. The marketing ones can only list a few things, but they cannot access the APIs to create, for example.</p>
  
  <p>I would like to know how I can do to make Api Gateway allow or deny access to certain application users, but based on the AWS Cognito user pool.</p>
  
  <p>PS: I have dealt with IAM roles in these groups, I have dealt with federated identities, but I don't know if I'm on the right path.</p>