Cognito User Pools Client Authentication

var data = {
  UserPoolId: <YOUR_USER_POOL_ID>,
  ClientId: <YOUR_USER_POOL_CLIENT_ID>,
};
var userPool = new AWSCognito.CognitoIdentityServiceProvider.CognitoUserPool(data);
var cognitoUser = userPool.getCurrentUser();

try {
  if (cognitoUser != null) {
    cognitoUser.getSession(function(err, session) {
      if (err) {
        console.log(err);
        return;
      }

      console.log('session validity: ' + session.isValid());
      console.log('session token: ' + session.getIdToken().getJwtToken());

      AWS.config.region = '<YOUR_REGION>';
      AWS.config.credentials = new AWS.CognitoIdentityCredentials({
        IdentityPoolId : '<YOUR_IDENTITY_POOL_ID>', 
        Logins : {
          // Change the key below according to the specific region your user pool is in.
          `cognito-idp.${AWS.config.region}.amazonaws.com/${data.UserPoolId}` : session.getIdToken().getJwtToken()
        }
      });

      AWS.config.credentials.get(function(err) {
        if (!err) {
          var id = AWS.config.credentials.identityId;
          console.log('Cognito Identity ID '+ id);

          // Instantiate aws sdk service objects now that the credentials have been updated
          var docClient = new AWS.DynamoDB.DocumentClient({ region: AWS.config.region });
          var params = {
            TableName: '<YOUR_DYNAMODB_TABLE>',
            Item:{userid:id, status:<STATUS_CODE>}
          };
          docClient.put(params, function(err, data) {
            if (err) 
			  console.error(err);
            else 
			  console.log(data);
          });
        }
      });
    });
  } else {
    console.log(err);
    return;
  }
} catch (e) {
  console.log(e);
  return;
}

https://aws.amazon.com/blogs/mobile/building-fine-grained-authorization-using-amazon-cognito-user-pools-groups/