@ZahidSaeed yeah, aws is quite overwhelming. If you have one API gateway, I assume you must write some code in your API. It seems to me that Cognito creates a JWT, and that tokens will contain information about which groups a user is assigned to. The API will receive the JWT on every request, so you should decode the token and then you can simply check if the user is member of the required group.