无服务器框架如何从 AWS Cognito 获取访问、ID 和刷新令牌

Question

我正在尝试使用 AWS Cognito 用户池保护我的无服务器 NodeJS api。

下面是我的无服务器框架配置示例：

service: hello-world
frameworkVersion: '3'

provider:
  name: aws
  runtime: nodejs14.x
  environment:
    user_pool_id: { Ref: UserPool }
    client_id: { Ref: UserClient }
  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - cognito-idp:AdminInitiateAuth
            - cognito-idp:AdminCreateUser
            - cognito-idp:AdminSetUserPassword
          Resource: "*"

functions:
  loginUser:
    handler: ./auth/login.handler
    events:
      - http:
          path: auth/login
          method: post
          cors: true

  signupUser:
    handler: ./auth/signup.handler
    events:
      - http:
          path: auth/signup
          method: post
          cors: true
  list:
    handler: ./users/users.handler
    events:
      - http:
          path: users/list
          method: get
          cors: true 
          authorizer:
             type: COGNITO_USER_POOLS
             authorizerId: 
               Ref: ApiGatewayAuthorizer

resources:
  Resources:
    ApiGatewayAuthorizer: 
      Type: AWS::ApiGateway::Authorizer
      Properties: 
        Name: CognitoUserPool
        Type: COGNITO_USER_POOLS
        IdentitySource: method.request.header.Authorization
        RestApiId: 
          Ref: ApiGatewayRestApi
        ProviderARNs: 
          - Fn::GetAtt:
              - UserPool
              - Arn
    UserPool:
      Type: AWS::Cognito::UserPool
      Properties:
        UserPoolName: serverless-auth-pool
        Schema:
          - Name: email
            Required: true
            Mutable: true
        Policies:
          PasswordPolicy:
            MinimumLength: 6
        AutoVerifiedAttributes: ["email"]
    UserClient:
      Type: AWS::Cognito::UserPoolClient
      Properties:
        ClientName: user-pool-ui
        GenerateSecret: false
        UserPoolId: { Ref: UserPool }
        AccessTokenValidity: 1
        IdTokenValidity: 1
        ExplicitAuthFlows:
          - "ADMIN_NO_SRP_AUTH"

我可以成功调用注册和登录端点来获取令牌，然后使用此令牌作为授权标头来调用我的

/users/list

端点以获取用户列表。

我的问题是我期望登录端点返回 3 个令牌 - 一个 ID 令牌、一个访问令牌和一个刷新令牌。

登录端点当前仅返回一个声明为：

"token_use": "id"

如果我将此令牌传递给

users/list

api，则它已成功验证，但我认为 api 需要访问令牌而不是 id 令牌进行身份验证。

有谁知道我的假设是否正确以及如何解决问题，或者我是否误解了授权流程的工作原理？