[JavaScript] Access S3 Bucket with RoleArn from AWS SDK v3

[rgare-travistrue]

We currently have a React app that uploads files to an S3 bucket directly by using v2 of the AWS SDK. I upgraded the code to use the AWS SDK's more modular design, but I'm getting a 403 Access Denied error with the v3 version.

Here's the original AWS SDK v2 code that worked:

async function authorize () {
  const session = await Auth.currentSession()
  const token = session.getIdToken().getJwtToken() /* using aws-amplify */

  AWS.config.credentials = new AWS.CognitoIdentityCredentials(
    {
      IdentityPoolId: process.env.IDENTITY_POOL_ID,
      RoleArn: process.env.ARN_USER_UPLOAD, /* this is important */
      Logins: {
        [process.env.COGNITO_LOGIN_DOMAIN]: token
      }
    },
    {
      region: process.env.REGION_MAIN
    }
  )
}

export function uploadFile (region, path, file) {
  await authorize()

  const upload = new S3.ManagedUpload({
    service: new S3({ region })
    params: {
      Bucket: process.env.S3_BUCKET,
      Key: `${path}/${file.name}`,
      Body: file
    }
  })

  /* wait for upload to finish, and update progress here */
}

Here's the v3 code that I came up with:

async function buildS3Service (region) {
  const session = await Auth.currentSession()
  const token = session.getIdToken().getJwtToken()

  return new S3Client({
    region,
    credentials: fromCognitoIdentityPool({
      identityPoolId: process.env.IDENTITY_POOL_ID,
      clientConfig: {
        region: process.env.REGION_MAIN
      },
      logins: {
        [process.env.COGNITO_LOGIN_DOMAIN]: token
      }
    })
  })
}

export function uploadFile (region, path, file) {
  const upload = new Upload({
    service: await buildS3Service(region),
    params: {
      Bucket: process.env.S3_BUCKET,
      Key: `${path}/${file.name}`,
      Body: file
    }
  })

  /* wait for upload to finish, and update progress here */
}

I'm fairly certain that I'm getting that 403 error because the v3 version doesn't provide the RoleArn. That said, what's the v3 equivalent of passing the RoleArn? I tried passing the ARN as the customArn parameters to fromCognitoIdentityPool(), but it was no luck.