AWS Cognito

Read the users and groups in an Amazon Cognito user pool, for example while you move its users to VAIF Studio.

Connect it in the console under Integrations > Connectors. See Connectors for how connectors work and who can use them.

Create a read-only credential

Create an IAM user with an access key and a policy that allows cognito-idp:ListUsers and cognito-idp:ListGroups on the user pool’s ARN, and nothing else.

Settings

Setting		Notes
Access key ID	Required	For example AKIA....
Secret access key	Required	Stored encrypted and never shown again.
User pool ID	Required	For example us-east-1_AbCdEf123.
Region	Optional	Read from the pool ID when left blank.

Tables

Table	Filters	Returns
users	username, email, page_token	Users in the pool (filter by username or email).
groups	page_token	Groups in the pool.

Query from the API

curl -s -X POST "https://api.vaif.studio/database/connector/$VAIF_PROJECT_ID/query" \
  -H "Authorization: Bearer $VAIF_TOKEN" -H "Content-Type: application/json" \
  -d '{"wrapperId":"cognito_fdw","table":"users","filters":{"email":"ada@example.com"},"limit":50}'

$VAIF_TOKEN is a console access token. See Connectors for the routes.

How it stays read-only

Give the key the two list actions only. Users come back 60 to a page, with their email and status.