title: Cognito Groups with IAM Permissions
body: <p>What I want to implement:</p>
  
  <p>I have a Cognito User-Pool and I have some Users and some Groups. I want that certain Users have access to API Gateway functions, some Users can access some functions and others have no access.</p>
  
  <p>What I did:</p>
  
  <p>I created three groups and assigned the Users to each of the groups. I gave each of the groups an IAM role and gave each roled spezific policies. The permission for the group for all users looks like this: </p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": "execute-api:*",
              "Resource": "*"
          }
       ]
  }
  </code></pre>
  
  <p>I created Lambda functions and API Gateway Resources through the Serverless framework. I set the authorizer to a Cognito User-Pool authorizer. </p>
  
  <p>(I tried a couple different things like using federated identities but that didnt seem to work as well)</p>
  
  <p>What is my result:</p>
  
  <p>All Users have full access to the API Gateway. The given permissions do not seem to make any difference to the access of each user.</p>
  
  <p>Help:
  What did I do wrong?
  How can I achieve my goal?</p>