AWS’s example turns an external user’s identity into tenant-scoped data access by mapping a Cognito custom:team claim to an IAM role. Athena runs queries with temporary credentials for that role, and Lake Formation applies its data permissions and filters. The flow is described in AWS’s tutorial on multi-tenant analytics with AgentCore and Lake Formation, published November 5, 2026.
From sign-in to a scoped Athena query
In the example, a user signs in through Amazon Cognito and receives an ID token containing a custom:team claim. The frontend sends that token and an access token to AgentCore Gateway. The gateway validates the access token and passes the ID token to a Lambda target in the X-ID-Token header.
The Lambda uses the ID token to request temporary credentials from a Cognito Identity Pool. Rules in the pool map the claim to a team IAM role. Athena then runs the query with those role credentials, while Lake Formation evaluates the role’s permissions and applicable filters before data is returned.
Why the Lambda acts as a credential broker
AWS’s example gives the Target Lambda two Cognito Identity actions: GetId and GetCredentialsForIdentity. Its execution role has no Athena, S3, or Glue data permissions. The team roles selected through Cognito handle data access, with Lake Formation applying further restrictions.
That division puts the query’s data permissions on the mapped role rather than on the intermediary Lambda. The Lambda brokers the credential exchange; Athena uses the resulting temporary credentials to query data.
What the team rules demonstrate
The example uses LF-Tags with the values TeamA, TeamB, and shared. It assigns the venue table to Team A, category to Team B, and users to both through the shared tag. For sales_extended, it configures team-specific row filters. The role names and tag values use TeamA and TeamB, while the example’s claim and row expression use the spaced values Team A and Team B.
The displayed Team A filter on sales_extended allows access to all columns and limits rows with the expression team = 'Team A'. That is a row filter, not column-level isolation.
The sample declares custom:team mutable, and that claim helps select the IAM role. As a result, controlling changes to the claim is part of the authorization boundary: a change to tenant identity can affect which data role a user receives.
Evaluate the tenant claim, role mapping, and data filters as parts of the same access-control path.
External-user identity and the documented checks
AWS presents Cognito User Pools and Identity Pools for external-facing applications. For workforce identities, the tutorial discusses IAM Identity Center with Trusted Identity Propagation.
Its validation walkthrough has operators sign in as Team A and Team B, check which tables each can see, and compare the rows returned from sales_extended. It then changes a table tag and Team A’s row filter and checks access again. AWS notes that Lake Formation permission changes may take several minutes to propagate.
