AWS Cognito 用户池中的用户可以分配给不同的 IAM 角色，以使用身份验证时访问不同的 AWS 资源。为此，您需要在 Cognito 用户池中配置“AWSLambdaInvoke”，然后在 IAM 中为这些调用创建 IAM 角色，该角色应该允许相应的 AWS 资源的访问。示例代码如下：

# 首先，您需要创建一个 IAM 策略，授予‘AWSLambdaInvoke’权限
policy_document = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:*:*:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeFunction"
            ],
            "Resource": "arn:aws:lambda:us-west-2:123456789012:function:my-function"
        }
    ]
}

# 通过 IAM 策略创建一个 IAM 角色
import boto3
iam_client = boto3.client('iam')
role_name = 'cognito_trusted_role'
role_description = 'Trusted role for users of AWS Cognito'
trust_policy = {
    'Version': '2012-10-17',
    'Statement': [
        {
            'Effect': 'Allow',
            'Principal': {'Federated': 'cognito-identity.amazonaws.com'},
            'Action': 'sts:AssumeRoleWithWebIdentity',
            'Condition': {
                'StringEquals': {
                    'cognito-identity.amazonaws.com:aud': 'us-west-2:12345678-abcd-1234-abcd-123456789012'
                },
                'ForAnyValue:StringLike': {
                    'cognito-identity.amazonaws.com:amr': 'authenticated'
                }
            }
        }
    ]
}
response = iam_client.create_role(
    RoleName=role_name,
    Description=role_description