Story:

I have a Cognito User Pool with Users.

This User Pool is an authentication provider in a Federated Identity Pool.

I have an S3 bucket where users are limited to uploading to a private path via a policy on the Auth Role as follows:

arn:aws:s3:::BUCKET_NAME/${cognito-identity.amazonaws.com:sub}/*

The users upload directly from the web browser via the aws javascript sdk.

Now this works great and my users are limited to where they upload. The files they upload end up with paths in the bucket looking like this:

us-east-1:0f26319c-1233-4c71-afb6-fac96a798ffb/random_file_name.txt

I then have a lambda which is triggered from this S3 bucket whenever a file is added. To clarify, the user does NOT invoke the lambda

Problem:

I would like to access the user's attributes in the user pool from the lamda. I thought that I could do this lookup using the cognito-identity sub. However, I can't seem to find a way using the SDK api's to allow this.

Using this api: http://boto3.readthedocs.io/en/latest/reference/services/cognito-identity.html#CognitoIdentity.Client.describe_identity I am able to get the login / the user pool but not the username associated with this Identity ID.

If I had the username, then I could use the api: http://boto3.readthedocs.io/en/latest/reference/services/cognito-idp.html?highlight=cognito#CognitoIdentityProvider.Client.admin_get_user

Any ideas how I can use the Federated Identity ID to lookup the user's attributes?