AWS cognito exchange token to credential in swift - swift

Question

i try to Accessing aws Services Using an Identity pool after Sign-in by this aws Doc
https://docs.aws.amazon.com/en_us/cognito/latest/developerguide/amazon-cognito-integrating-user-pools-with-identity-pools.html
but in Integrating a User Pool with an Identity Pool part,
i can't add the token in the swift code
let serviceConfiguration = AWSServiceConfiguration(region: .USEast1, credentialsProvider: nil)
let userPoolConfiguration = AWSCognitoIdentityUserPoolConfiguration(clientId: "YOUR_CLIENT_ID", clientSecret: "YOUR_CLIENT_SECRET", poolId: "YOUR_USER_POOL_ID")
AWSCognitoIdentityUserPool.registerCognitoIdentityUserPoolWithConfiguration(serviceConfiguration, userPoolConfiguration: userPoolConfiguration, forKey: "UserPool")
let pool = AWSCognitoIdentityUserPool(forKey: "UserPool")
let credentialsProvider = AWSCognitoCredentialsProvider(regionType: .USEast1, identityPoolId: "YOUR_IDENTITY_POOL_ID", identityProviderManager:pool)
In javascript and android both have credentialsProvider.logins .
i got the message like this:
Message: The security token included in the request is invalid.
or i need to call aws sts api by this doc?
https://docs.aws.amazon.com/en_us/IAM/latest/UserGuide/id_credentials_temp_request.html
Thanks for help.

Answer 1

first i try this
let identity = AWSCognitoIdentity.default()
let input = AWSCognitoIdentityGetCredentialsForIdentityInput()
input?.identityId = identityid
input?.logins = ["cognito-idp.us-east-1.amazonaws.com/us-east-1_XXXXX":identityToken]
identity.getCredentialsForIdentity(input!).continueWith(block: { (task:AWSTask<AWSCognitoIdentityGetCredentialsForIdentityResponse>) -> Any? in
if (task.error != nil) {
print("Error: " + task.error!.localizedDescription)
}
else {
self.accessKey = (task.result?.credentials?.accessKeyId)!
self.secrectKey = (task.result?.credentials?.secretKey)!
self.sessionToken = (task.result?.credentials?.sessionToken)
}
return task;
})
but it's not work, i'm not sure what happen. i use https to get aws iot shadow, it will return null value and get 403 message.
then i change the official doc code like this
let serviceConfiguration = AWSServiceConfiguration(region: .USEast1,credentialsProvider: nil)
let userPoolConfiguration = AWSCognitoIdentityUserPoolConfiguration(clientId: "YOUR_CLIENT_ID", clientSecret: "YOUR_CLIENT_SECRET", poolId: "YOUR_USER_POOL_ID")
AWSCognitoIdentityUserPool.registerCognitoIdentityUserPoolWithConfiguration(serviceConfiguration, userPoolConfiguration: userPoolConfiguration, forKey: "UserPool")
let pool = AWSCognitoIdentityUserPool(forKey: "UserPool")
let credentialsProvider = AWSCognitoCredentialsProvider(regionType: .USEast1, identityPoolId: "YOUR_IDENTITY_POOL_ID", identityProviderManager:pool)
then use this code
credentialsProvider.credentials().continueWith(block: { (task) -> AnyObject? in
if (task.error != nil) {
print("Error: " + task.error!.localizedDescription)
}
else {
let credentials = task.result!
self.accessKey = credentials.accessKey
self.secrectKey = credentials.secretKey
self.session = credentials.sessionKey! }
return task;
})
but this code is not use idtoken i got from cognito login, maybe this just let me access service, then i can parse the idtoken to get the idtoken detail message.
hope this will help to someone.
in addition to this, the import things is to attachPrincipalPolicy you temporary credential with iot, when you login cognito, you will get credential identityID,
then used this identityID to attach.
or you will get 403 forbidden, and a null return values.
FYR
https://github.com/awslabs/aws-sdk-ios-samples/blob/master/IoT-Sample/Swift/IoTSampleSwift/ConnectionViewController.swift