If using multiple UserPool's "App clients", do I need to add them all to IdentityPool's "Authentication providers"?

Question

I'm writing a web app which is using AWS Cognito UserPools for user authentication and IdentityPools for granting direct access to an S3 bucket.

This JavaScript web app has its own App client ID in the UserPool with which it interacts with it.

I also have a couple of Lambda functions doing some admin functions towards the UserPool and IdentityPool. These lambda functions have their own App client ID.

I used to have only a single Authentication provider added to the IdentityPool, with the same App Client ID that the lambda functions have set.

In this setup, the web app was having issues. I was able to authenticate towards the UserPool, but when the identity token was sent to the IdentityPool, I received an error "Token is not from a supported provider of this identity pool.". I believe this was because the aud parameter of the JWT was set to the UserPool ID which was not added to the IdentityPool

I eventually realized that I could get rid of the error if I added another "Authentication provider" to the IdentityPool, filling in the same UserPool ID and the other App client ID.

My question now is - is this the correct approach? Am I perhaps misunderstanding the App client ID meaning and usage? Am I way off base with my approach?

Answer 1

Yes that sounds like a perfectly good approach. If you don't encounter any security or functional issues it is the "correct" approach.