AWS has been adding a lot of features to use OAuth directly with API Gateway, skipping Cognito Identity Pools and AWS IAM. I think this is regressive. A lot of useful functionality is coming out of it, but we should hope to get that IAM-side instead.
For example, using OAuth, you can define allowed scopes on a given route (resource+method). Now you've got attribute-based access control in your app. Great! Except all the excellent tooling around AWS IAM is no longer available to you.
Or, you can use a Lambda authorizer to create a policy based on the token contents. It's super flexible, you can accomplish complicated authorization scenarios. But now you own the authorization system, including all the security monitoring and operations associated with that.
The governance part is more important, but more subtle difference is that you're using a bearer token. A JWT that asserts identity but contains no proof it hasn't changed hands. With AWS IAM, SigV4 signing proves for every call that the caller has the secret access key.
Give us the right capabilities to stay in IAM. Let me turn attributes in Cognito User Pools into session tags through Cognito Identity. Let me tag API Gateway resources and methods, so I can leverage that in IAM policies. Let me compare path & query params against principal tags.
Fundamentally, give us the tools to stay with a fully managed authorization system, rather than pushing that responsibility back onto us. Authorization is hard to get right and bad to get wrong.
To clarify, an example: IAM has added capabilities like attribute-based access control through session tags. Cognito has added ABAC thru OAuth scopes. I know it's nontrivial to add session tags to Cognito. I'm arguing for putting in the effort. (thanks @hotgazpacho for feedback)
@hotgazpacho I should say, it's the combination of session tags in Cognito and tags on more resources (routes, methods, etc.) in API Gateway, and the ability to leverage those tags in policies (I guess the resourceTag set is the overlay of the various hierarchical resources involved)
