I have two B2B apps, one for suppliers and the other for purchasers. The supplier app is a .NET Core app fully hosted in AWS, users are authenticated in Cognito, API gateway is used, RDS, ECS, etc. The second app is older and not hosted in AWS. The AWS app owns the REST API and the other app needs to leverage that API for certain things. I'd like to setup row-level security in Postgres so that queries made by suppliers filter by supplier_id and the ones made by purchasers filter by purchaser_id. My understanding is that the best way to do RLS is to use Postgres settings/variables and then have your policy leverage something like current_setting('app.supplier_id') or current_setting('app.purchaseorder_id') to filter the data. I'm just not sure how to tie all this together.

The simple way that comes to mind is to setup an app client in Cognito and enable client credentials grant type, then the second app could leverage that to get a token. When a request to the API is made, a middleware would check the JWT token and use a different account based on if it's a supplier or purchaser accessing. It would then also set an app.supplier_id or app.purchaser_id on the Postgres connection and the RLS would take care of the rest. I'm just not sure this is the best approach or if there would be a more elegant way.