Question

A developer builds a single-page application (SPA) that must let users sign in and then call a custom REST API secured behind Amazon API Gateway. The team uses an Amazon Cognito user pool with the hosted UI and defines a resource server with custom scopes (for example, orders/read and orders/write). The developer must ensure the SPA receives a token that carries the granted OAuth 2.0 scopes so that API Gateway can authorize access to specific API operations. Which token issued by Cognito should the application send to API Gateway for scope-based authorization?

Accepted Answer

The access token, because it contains the scope claim reflecting the authorized custom scopes.

Answer

The ID token, because it identifies the user and includes all custom scopes in its claims.

Answer

The refresh token, because it can be exchanged directly at API Gateway for scoped permissions.

Answer

A temporary AWS credentials set from a Cognito identity pool, because scopes map to IAM policies.