Which of the following is a possible reason that the developer’s department is still being reported as Engineering instead of Sales?
Authorization caching is enabled in the custom Lambda authorizer.
Authorization caching is enabled on the Amazon Cognito user pool.
The IAM role for the custom Lambda authorizer does not have a Department tag.
The IAM role for the Amazon Cognito user pool does not have a Department tag.
Explanations:
Authorization caching in the custom Lambda authorizer could cause it to reuse old data, such as the outdated “Engineering” department attribute. This means that even after the developer updates the department in the IdP, the cached authorization data from the previous session might still be used.
Authorization caching in the Amazon Cognito user pool would affect authentication but not the department attribute passed to the Lambda authorizer. The issue here lies with the authorizer, not the Cognito user pool caching.
The IAM role for the custom Lambda authorizer does not need a Department tag. The authorizer’s function is to validate the claims (such as the Department attribute) passed in the token, not rely on IAM role tags for this purpose.
The IAM role for the Amazon Cognito user pool does not need a Department tag to pass the Department attribute to the Lambda authorizer. The mapping of the attribute is handled in Cognito settings, not by IAM role tags.
I calculate that the answer is:
Authorization caching is enabled in the custom Lambda authorizer.