title: Restrict login to Enterprise Google Domain for AWS Federated Identity Pool
body: <p>I'm using a federation identity pools with aws-amplify (<a href="https://aws.github.io/aws-amplify/media/authentication_guide#enabling-federated-identities" rel="noreferrer">https://aws.github.io/aws-amplify/media/authentication_guide#enabling-federated-identities</a>) and I'd like to restrict the scope of domains to just my google domain organization (ex. johndoe@foobar.com).</p>
  
  <p>There doesn't seem to be a way to lock it down on either the Google API console or the AWS Cognito Identity Pool settings, just a hint that an hd parameter can be appended to the google request to restrict it by domain (which would still require modifying the aws-amplify core package), and it still wouldn't be secure since anyone could just make the same request without the hd and gain access to cognito.</p>
  
  <p>My question is this: is there a way to restrict a google oauth key to only allow @foobar.com email addresses, or to implement the same restriction with aws cognito?</p>