---
title: "Using AWS Cognito with Cerbos"
description: "Learn how to integrate your users and roles in AWS Cognito with Cerbos for powerful, fine-grained access control."
author: "Alex Olivier"
date: "2022-05-26T00:00:00.000Z"
canonical: "https://www.cerbos.dev/blog/using-aws-cognito-with-cerbos"
image: "https://stylish-appliance-1c1cc1c30d.media.strapiapp.com/cover_image_ac44dea11a.png"
tags: ["documentation","guide","integration"]
source: "https://www.cerbos.dev/blog/using-aws-cognito-with-cerbos"
---

# Using AWS Cognito with Cerbos

In this blog, we will be going through the process of integrating your users and roles in AWS Cognito with Cerbos for powerful, fine-grained access control.

Cerbos integrates with many authentication providers. Our [AWS Cognito](https://aws.amazon.com/cognito/) integration works with the same principle that all of our other authentication integrations ([Okta](https://cerbos.dev/ecosystem/cerbos-okta), [Auth0](https://cerbos.dev/ecosystem/cerbos-auth0), [WorkOS](https://cerbos.dev/ecosystem/cerbos-workos) etc).

It relies on getting the identity object and combining it with the resource that user is trying to access and ask the question whether that user is allowed to do that action on the said principal. For example, “can a user who is a manager in the northeast region approve an expense report that belongs to an employee from the south region in the amount of $5000?” or perhaps $10,000, and $50,000 for different groups of users: the point being without having to create a whole new user group for each threshold.

![Cognito with Cerbos](https://cerbos.dev/blog-images/2022-05-26_using-aws-cognito-with-cerbos-diagram.png)

Following is an example of what this may look like in your application code. It simply grabs the profile from [Cognito](https://aws.amazon.com/cognito/) and passes it over to Cerbos in the principal object. You can see a full example on [GitHub](https://github.com/cerbos/python-cognito-cerbos) which showcases how to use it in a Python [FastAPI](https://fastapi.tiangolo.com/) project..

```python
@app.get("/user", response_class=HTMLResponse)
async def user(request: Request, credentials: dict = Depends(get_user_from_session)):
    claims = credentials.claims
    user_id: str = claims["sub"]
    roles: list[str] = claims.get("cognito:groups", [])

    principal = Principal(
        user_id,
        roles=roles,
        policy_version="20210210",
        attr={
            "foo": "bar",
        },
    )

    # resources would usually be retrieved from your data store
    actions = ["read", "update", "delete"]
    resource_list = ResourceList(
        resources=[
            # This resource is owned by the user making the request
            ResourceAction(
                Resource(
                    "abc123",
                    "contact",
                    attr={
                        "owner": user_id,
                    },
                ),
                actions=actions,
            ),
            # This resource is owned by someone else
            ResourceAction(
                Resource(
                    "def456",
                    "contact",
                    attr={
                        "owner": "other_user_id",
                    },
                ),
                actions=actions,
            ),
        ]
    )

    with CerbosClient(host="http://localhost:3592") as c:
        # usually check for a specific action
        action = "read"
        if not c.is_allowed(action, principal, r):
            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Unauthorized")
        return {
            "id": user_id,
            "foo": "bar",
        }


```

You can find out more about [Cognito on the AWS Developer site](https://aws.amazon.com/cognito/), our [integration](https://github.com/cerbos/python-cognito-cerbos), as well as our other integrations such as [Auth0](https://cerbos.dev/ecosystem/cerbos-auth0), [Okta](https://cerbos.dev/ecosystem/cerbos-okta) and [WorkOS](https://cerbos.dev/ecosystem/cerbos-workos) and more on the [Ecosystem page](https://cerbos.dev/ecosystem).

[Check out part 2 here](https://www.cerbos.dev/blog/using-aws-cognito-with-cerbos-how-to)