Grant access to auth resources
Amplify Auth can be defined with an access property, which allows other resources to interact with auth by specifying actions.
amplify/auth/resource.ts
import { defineAuth } from "@aws-amplify/backend"import { addUserToGroup } from "../functions/add-user-to-group/resource"
/** * Define and configure your auth resource * @see https://docs.amplify.aws/gen2/build-a-backend/auth */export const auth = defineAuth({ loginWith: { email: true, }, access: (allow) => [ allow.resource(addUserToGroup).to(["addUserToGroup"]) ],})List of actions
| Action Name | Description | Cognito IAM Actions |
|---|---|---|
| manageUsers | Grants CRUD access to users in the UserPool |
|
| manageGroupMembership | Grants permission to add and remove users from groups |
|
| manageGroups | Grants CRUD access to groups in the UserPool |
|
| manageUserDevices | Manages devices registered to users |
|
| managePasswordRecovery | Grants permission to reset user passwords |
|
| addUserToGroup | Grants permission to add any user to any group. |
|
| createUser | Grants permission to create new users and send welcome messages via email or SMS. |
|
| deleteUser | Grants permission to delete any user |
|
| deleteUserAttributes | Grants permission to delete attributes from any user |
|
| disableUser | Grants permission to deactivate any user |
|
| enableUser | Grants permission to activate any user |
|
| forgetDevice | Grants permission to deregister any user's devices |
|
| getDevice | Grants permission to get information about any user's devices |
|
| getUser | Grants permission to look up any user by user name |
|
| listUsers | Grants permission to list users and their basic details in the UserPool |
|
| listDevices | Grants permission to list any user's remembered devices |
|
| listGroupsForUser | Grants permission to list the groups that any user belongs to |
|
| listUsersInGroup | Grants permission to list users in the specified group |
|
| removeUserFromGroup | Grants permission to remove any user from any group |
|
| resetUserPassword | Grants permission to reset any user's password |
|
| setUserMfaPreference | Grants permission to set any user's preferred MFA method |
|
| setUserPassword | Grants permission to set any user's password |
|
| setUserSettings | Grants permission to set user settings for any user |
|
| updateDeviceStatus | Grants permission to update the status of any user's remembered devices |
|
| updateUserAttributes | Grants permission to updates any user's standard or custom attributes |
|