I have built an application on AWS which integrates AWS Cognito with Okta as described in this blog Building an application with AWS Amplify, Amazon Cognito, and an OpenID Connect Identity Provider I now have added some groups in Okta which I would like to use in the application for group based access control with group membership manged in Okta, not in AWS Cognito. The groups have been added in Okta to the identity token using a Groups claim expression and they have been whitelisted by an admin. How can I access the group claim in the tokens that AWS Cognito will provide so that I can use them for group based authorisation in the app? Do I need to do any attribute mapping and is this documented anywhere?