Q: Does AWS lambda use Cognito policy variables when getting temporary permissions? I'm invoking a lambda directly from Android using a Cognito credentials provider authenticated with Google.  The role I get by using that credentials provider allows me to invoke the lambda.  I can see in my CloudWatch logs that the lambda does indeed receive the user's Cognito identity in the context variable passed to the lambda handler.  The lambda assumes a role that uses this identity variable to limit the lambda's access to a specific S3 user folder named by the Cognito identity variable.
{
    "Effect":"Allow",
    "Action":[
        "s3:GetObject",
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:DeleteObject"
    ],
    "Resource":[
        "arn:aws:s3:::BUCKET_NAME/users/${c­ognito-identity.amazonaws.com:sub}/"­,
        "arn:aws:s3:::BUCKET_NAME/users/${c­ognito-identity.amazonaws.com:sub}/*"        ­
    ]
},
{
    "Effect":"Allow",
    "Action":[
        "s3:ListBucket",
        "s3:ListObjects"
    ],
    "Resource":[
        "arn:aws:s3:::BUCKET_NAME"
    ],
    "Condition":{
        "StringLike":{
            "s3:prefix":[
                "users/${cognito-identity.amazonaws­.com:sub}/",
                "users/${cognito-identity.amazonaws­.com:sub}/*"
            ]
        }
    }
}

However, the lambda doesn't seem to be inheriting these environment variable specific limitations.  In order for the lambda code to work, I need to loosen the constraints like this:
{
    "Effect":"Allow",
    "Action":[
        "s3:GetObject",
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:DeleteObject"
    ],
    "Resource":[
        "arn:aws:s3:::BUCKET_NAME/users/*"        ­
    ]
},
{
    "Effect":"Allow",
    "Action":[
        "s3:ListBucket",
        "s3:ListObjects"
    ],
    "Resource":[
        "arn:aws:s3:::BUCKET_NAME"
    ],
    "Condition":{
        "StringLike":{
            "s3:prefix":[
                "users/*"

            ]
        }
    }
}

I think it has to do with the lambda service assuming the role. If I use the role directly with an S3 client the limitations seem to work. The client has access to its own folder, but no one else's. However, if the lambda assumes the role it doesn't work, and I have to loosen the policy constraints. Am I doing something wrong or misunderstanding something?

A: Ok, I think I figured this out.  Correct me if I'm wrong.  It looks like I need TWO roles.  One role that the lambda will assume to do whatever it needs to do.  That particular role can't be limited by any Cognito login credentials because when the Lambda service assumes this role, it doesn't have access to those credentials.  The security comes from a SECOND role that has permission to INVOKE the lambda but does NOT have full access to all of S3 like the Lambda role does.  That role can and should require authentication.  The net effect is that you can require authentication to invoke the lambda, but you have to be careful in the lambda code itself to not access any resources that you shouldn't.  The Cognito credentials are passed into the lambda function (because you invoked it with an authenticated role) so you know from the context what resource you should be working on, that is, what user folder in S3.
