Users authenticate to an API via a third-party IdP through Amazon Cognito. The developer mapped the IdP attribute Department to a custom Lambda authorizer, intending to allow only Sales department users. The developer changes their department to Sales in the IdP but is still denied access; logs show the access token still has Department=Engineering. What might explain why the token still reports Engineering instead of Sales?

The custom Lambda authorizer likely has authorization caching enabled. When caching is active, the authorizer stores the results of previous authorization decisions for a configurable time-to-live (TTL). If the user's token was previously associated with Department=Engineering and cached, subsequent requests will use the cached decision even after the user's attribute changes in the IdP, until the cache expires. Authorization caching on the Amazon Cognito user pool is not a standard feature that would directly impact the content of an access token or the Lambda authorizer's decision. IAM roles and their tags are used for permissions within AWS, not for passing or modifying user attributes within an access token or for the logic of a custom Lambda authorizer.