I’ve developed an integration platform for a customer where their clients can get access to their own data, as well as my customers internal systems. The architecture consist of data in S3 and DynamoDB, authentication through Cognito and access via API Gateway.

All calls with be executed by M2M (machine to machine), which usually is handled by utilizing oauth2 with client id and client secrets. Since for Cognito you cannot create this for a user but only an app client, I have three user pools with app clients:

• My customer’s SAP S/4HANA instance
• My customer’s SAP BTP instance
• My customer’s API clients

The first two use app client id and client secret, but all external M2M’s use Lambda Authrorizer function which returns IAM roles based on the group assignment in their user pool. This works very well, but I don’t think it scales at it should. If one client should only have access to e.g api v1/products/get and another one also v1/products/patch I would need two different groups just for this scenario. Over the years, we would almost need one group per endpoint-method and each user would need to be part of several groups.

My question is:
Is this a recommended/viable approach for M2M access or is there a better, more standard way of solving this? (e.g OpenId scopes..) It is important to provide a standardized way of authentiaction so that all kinds of systems can enable integrations to this platform. ClientId and Client Secret with token endpoint would have been the perfect option, but having hundreds or thousands of app clients in cognito doesn’t seem right…