Ok, so there's no right way to map Cognito identity ID and Cognito user. There is a lengthy discussion here where a couple of workarounds can be found. For now, I'm going to use this solution where, instead of identity_id, you can specify a custom attribute (most likely a sub) as a folder name.

EDIT: There is another solution that might help (found somewhere on the internet, and I verified that it works)

const AWS = require('aws-sdk')
const cognitoIdentity = new AWS.CognitoIdentity();

function getCognitoIdentityId(jwtToken) {
  const params = getCognitoIdentityIdParams(jwtToken);
  return cognitoIdentity
    .getId(params)
    .promise()
    .then(data => {
      if (data.IdentityId) {
        return data.IdentityId;
      }
      throw new Error('Invalid authorization token.');
    });
}

function getCognitoIdentityIdParams(jwtToken) {
  const loginsKey = `cognito-idp.${process.env.REGION}.amazonaws.com/${process.env.USERPOOLID}`;
  return {
    IdentityPoolId: `${process.env.IDENTITY_POOL_ID}`,
    Logins: {
      [loginsKey]: jwtToken,
    },
  };
}

If the user accesses the lambda through graphql via the AppSync service then the identity is stored event.identity.owner

Here is some typescript code I use to pull the user_identity_id from the event. However, the user doesn't always call the lambda direct sp the user_identity can also be based in if from an authorized IAM role.

export function ownerFromEvent(event: any = {}): string {
  if (
    event.identity.userArn &&
    event.identity.userArn.split(":")[5].startsWith("assumed-role")
  ) {
    // This is a request from a function over IAM.
    return event.arguments.input.asData.owner;
  } else {
    return event.identity.owner;
  }
}