Cognito auth tutorial is faulty

[TeoTN]

The Cognito auth tutorial is faulty and technically it won't work.

The problem is that up until recently (it changed two weeks ago on the 13/12/2023) Cognito didn't support adding custom claims to access token at all (see this announcement). Now it technically does offer the customisation but the feature requires enabling Advanced Security Shenanigans, which are super duper costly, and the tutorial doesn't cover this at all.

So if you checked your tokens post-authentication like this:

import { fetchAuthSession } from 'aws-amplify/auth';

const session = await fetchAuthSession();
console.log('session', session);

You'll find out that while id token gets updated, the access token doesn't have the claims (unless you're willing to pay up to $2500 for 50k MAU offered by Free Tier Cognito)

[TeoTN]

I think the recommended solution should be to use the claims_map instead of pre-token generation lambda.