Using attribute-based access control with Amazon Cognito identity pools