Amplify-cli: Best way to add a custom role to a group (eg. "Admin") in a cognito userpool group generated by Auth?

[ajhool]

Note: If your question is regarding the AWS Amplify Console service, please log it in the
official AWS Amplify Console forum

* Which Category is your question related to? *
Mainly Auth, but also Storage related

* What AWS Services are you utilizing? *
Cognito federated identity pools and S3.

* Provide additional details e.g. code snippets *
My goal is to grant users in an "Admin" cognito group the ability to access all S3 objects. I believe that the best way to do this is by attaching a role to the "Admin" group in the cognito userpool, and I'm curious:

A. Will the role grant permissions in addition to the permissions granted to all members of the cognito group, or will it become the only source of permissions for any user in that group?

and

B. What is the best way to add this role into the Amplify framework?

[undefobj]

We are actively working on this as part of: https://github.com/aws-amplify/amplify-cli/issues/766

There are three final pieces of this RFC:

• Admin Queries to perform actions like list users, add user to group, etc.
• Creation of User Pool Groups and setting the priorities, as well as attaching Roles to the Groups.
• Ability to configure custom Rules/Roles when JWT tokens are passed to Identity Pools.

We've got about half of this code done, and are trying to get it released next month after testing and further UX validation.

cc @kaustavghosh06

[ajhool]

Brilliant, thanks.

[undefobj]

This has now been released:

https://aws-amplify.github.io/docs/cli-toolchain/quickstart#group-management
https://aws-amplify.github.io/docs/cli-toolchain/quickstart#group-access-controls
https://aws-amplify.github.io/docs/cli-toolchain/quickstart#administrative-actions