title: Get I Access Cognito Identity in Lambda function? Full example with some part of the puzzle missing
body: <p>I have read some AWS docs and many questions about accessing Cognito Identity in a Lambda function and this is my best attempt so far. But it is not working. Tell me what might be missing!</p>
  
  <p><strong>Client</strong></p>
  
  <p>I call the Lambda function from my client</p>
  
  <pre><code>fetch('api/public/libraries/sign-out-discourse', {
      method: 'GET',
      headers: new Headers([
          ['Accept', 'application/json'],
          ['Content-Type', 'application/json'],
          // I get the idToken from CognitoUser.getSession =&gt; getIdToken(). It is possible to get a jwtToken without decoded payload with getIdToken().getJwtToken(). I think it is the idToken and not the jwtToken I should send to the API Gateway, but I am not sure.
          ['Authorization', idToken],
      ]),
  })
  </code></pre>
  
  <p><strong>API Gateway</strong></p>
  
  <p><em>Resource method</em></p>
  
  <pre><code>GET
  </code></pre>
  
  <p><em>Settings</em></p>
  
  <pre><code>Auth: AWS_IAM
  Integration type: Lambda Function
  // I don't know if Execution role is relevant
  Execution role: arn:aws:iam::*:user/*
  Invoke with caller credentials: true
  // I don't know if Credentials cache is relevant
  Credentials cache: Add caller's principal to the cache key
  </code></pre>
  
  <p><em>Mapping template</em> </p>
  
  <p>I have no idea what I am doing here
  I don't know if this template does anything for GET requests where there is no body being sent from the client.</p>
  
  <p>Settings</p>
  
  <pre><code>Request body passthrough: When there are no templates defined (recommended)
  Content-Type: application/json
  </code></pre>
  
  <p>Template code</p>
  
  <pre><code>// The template is based on the default template. The only thing I have added is username to event and context.
  
  #set($allParams = $input.params())
  {
  "body-json" : $input.json('$'),
  "params" : {
  #foreach($type in $allParams.keySet())
      #set($params = $allParams.get($type))
  "$type" : {
      #foreach($paramName in $params.keySet())
      "$paramName" : "$util.escapeJavaScript($params.get($paramName))"
          #if($foreach.hasNext),#end
      #end
  }
      #if($foreach.hasNext),#end
  #end
  },
  "stage-variables" : {
  #foreach($key in $stageVariables.keySet())
  "$key" : "$util.escapeJavaScript($stageVariables.get($key))"
      #if($foreach.hasNext),#end
  #end
  },
  "context" : {
      "account-id" : "$context.identity.accountId",
      "api-id" : "$context.apiId",
      "api-key" : "$context.identity.apiKey",
      "authorizer-principal-id" : "$context.authorizer.principalId",
      "caller" : "$context.identity.caller",
      "cognito-authentication-provider" : "$context.identity.cognitoAuthenticationProvider",
      "cognito-authentication-type" : "$context.identity.cognitoAuthenticationType",
      "cognito-identity-id" : "$context.identity.cognitoIdentityId",
      "cognito-identity-pool-id" : "$context.identity.cognitoIdentityPoolId",
      "http-method" : "$context.httpMethod",
      "stage" : "$context.stage",
      "source-ip" : "$context.identity.sourceIp",
      "user" : "$context.identity.user",
      "user-agent" : "$context.identity.userAgent",
      "user-arn" : "$context.identity.userArn",
      "request-id" : "$context.requestId",
      "resource-id" : "$context.resourceId",
      "resource-path" : "$context.resourcePath",
      "username" : "$context.authorizer.claims['cognito:username']"
      }
  }
  "event" : {
      "username" : "$context.authorizer.claims['cognito:username']"
  }
  </code></pre>
  
  <p><em>Authorizer</em></p>
  
  <p>I added an authorizer:</p>
  
  <pre><code>Name: Something something
  Type: Cognito
  Cognito user pool: Choose the user pool from the drop down
  Token Source: Authorization
  Token Validation: //blank
  </code></pre>
  
  <p><strong>Lambda function</strong></p>
  
  <p>The runtime is Node 6.</p>
  
  <pre><code>'use strict';
  
  const util = require('util');
  
  exports.handler = (event, context, callback) =&gt; {
      console.log(util.inspect(event, {
          showHidden: false,
          depth: null
      }));
      console.log(util.inspect(context, {
          showHidden: false,
          depth: null
      }));
      console.log(util.inspect(callback, {
          showHidden: false,
          depth: null
      }));
  }
  </code></pre>
  
  <p><strong>Console logs</strong></p>
  
  <p>username is not a property on event and not a property on context.</p>
  
  <p>the event object has a disappointing identity property.</p>
  
  <pre><code>identity: 
  {
      cognitoIdentityPoolId: null,
      accountId: null,
      cognitoIdentityId: null,
      caller: null,
      sourceIp: 'redacted',
      accessKey: null,
      cognitoAuthenticationType: null,
      cognitoAuthenticationProvider: null,
      userArn: null,
      userAgent: 'Amazon CloudFront',
      user: null },
      apiId: 'redacted' },
      body: null,
      isBase64Encoded: false 
  }
  </code></pre>