What is Cognito in AWS?

Web applications usually allow a valid username and password combination for successful sign-in to the application. Modern authentication flows incorporate more approaches to ensure user authentication. When using AWS, this is no exception, thanks to the abilities and features offered by AWS Cognito.

Amazon Cognito service is designed to provide APIs and infrastructure for key features in the user management space such as authentication, authorisation, and managing user repository with different operations for your web and mobile apps.

This blog is part of the AWS Solutions Architect – Associate Certification Preparation. This learning path is specifically designed to prepare you for the AWS Certified Solutions Architect – Associate exam released in March 2020.

Modern authentication flows

Key components of Amazon Cognito

In general, any user management and identity management services are built upon two key functions: authentication and authorization.

• Authentication is the process of validating your claims on identity. For example, you could prove your identity with a passport for security check-in at an airport.
• Authorization is the process of providing confirmation on your access rights to other AWS resources and services. For example, you could show a boarding pass to get into the flight.

User Pools and Identity Pools are the two main components in Amazon Cognito:

1. User Pools:

   • Purpose: User pools are repositories where user profile details are stored. When new users sign up using your web or mobile applications, this user pool will be updated. As a result, when users sign in, their credentials are authenticated against the data in the user pool.
   • Functionality: A user pool takes care of providing authentication to users who sign in through your web or mobile application. Once a user is authenticated, Amazon Cognito returns user pool tokens to your application. It also supports social sign-ins (e.g., Google) and sign-ins with SAML identity providers.

2. Identity Pools:

   • Purpose: Identity pools simplify authenticated user access to other AWS resources. An identity pool issues temporary AWS credentials to your users, allowing them to access other AWS resources without needing to re-enter their credentials.
   • Functionality: Identity pools can be used to provide temporary access to AWS resources. They can be used separately from user pools or together. In a typical scenario, identity pools manage the authorization by issuing temporary access tokens or AWS credentials.

Comparison and Workflow:

• In an enterprise intranet network, users sign in using a user ID and password. If the user ID and password are validated successfully, they can enter the network. This process is called authentication and is performed by the user pool.
• Once authenticated, if users want to access internal services or resources, they don’t need to re-enter their login credentials. Access is granted based on policies and rules configured. This process is called authorization and is managed by the identity pool.

Simplified Workflow:

1. Authentication: Performed first by validating user credentials against the user pool.
2. Authorization: Performed afterward by managing access rights and issuing temporary credentials or tokens through the identity pool.

Standards:

• OpenID Connect is a reference for authentication.
• OAuth 2.0 is a reference for authorization.

Amazon Cognito User Pool Overview: A user pool in Amazon Cognito is a user directory that provides authentication for users who sign in through your web or mobile application. Once authenticated, Amazon Cognito returns tokens to your application. Additionally, it supports social sign-ins (e.g., Google) and sign-ins through SAML identity providers.

Source: Using Tokens with User Pools

 Source: Amazon Cognito User Pools

These tokens can be classified into ID token and access token. Your users could perform the following activities by using these tokens. Your client web and mobile applications can access your own server-side components such as a database.

 Source: Access Your Server-side Resources with a User Pool

You can provide option to your users to access your API using API Gateway. API Gateway validates the tokens and uses them to grant your users access to resources including Lambda functions, or your own API

 Source: Access Resources with API Gateway and Lambda with a User Pool Your client applications can exchange these tokens for temporary AWS credentials to access other AWS services from the identity pool of Amazon Cognito.

 Source: Access AWS Services with a User Pool and an Identity Pool

You can refresh tokens as they expire one hour after authentication. You can also revoke these tokens if needed.

User Pool Features:

• Import User Data: Import CSV file contents into the user pool, where the CSV file contains existing users' credentials.
• Sign-Up and Sign-In: Provides sign-up and sign-in features with a ready-made, customizable web UI.
• User Directory Management: Manages user profiles and directories.
• Security Features: Includes multi-factor authentication (MFA) and compromised credentials checks.
• Account Protection: Features account takeover protection and verification through phone and email.
• Custom Workflows: Supports creating customized workflows and user migration through AWS Lambda triggers.

Amazon Cognito API for Developers – User Pool:

For those with a software development background, here is an overview of the user authentication flow:

• Authentication Workflows: You can configure different authentication workflows by setting up a series of challenges in the user pool. Based on the authentication flow, users must answer additional challenges until authentication either fails or the user is assigned tokens.

APIs Used:

1. InitiateAuth: Begins the authentication process.
2. RespondToAuthChallenge: Handles responses to authentication challenges. This API can be repeated with different challenges to support any custom authentication flow.

These APIs work together in a sequence of request and response calls to handle various authentication scenarios and custom flows.

 Source: User Pool Authentication Flow

Amazon Cognito pools

Amazon Cognito identity pool

An identity pool in Amazon Cognito authorises users to access other AWS services without requiring further user authentication. It helps create identities for users and assign permissions using IAM roles. Through the identity pool, users can gain access to various AWS services based on their identity information.

An identity pool can include:

• Users from Amazon Cognito User Pool: Users who have been authenticated via the Amazon Cognito user pool.
• Users from External Identity Providers: Users who authenticate through external providers such as Facebook, Google, etc.
• Users from Custom Authentication Processes: Users authenticated through their own authentication mechanisms.

 Source: Authenticate with a Third Party and Access AWS Services with an Identity Pool 

Identity pools in Amazon Cognito also support unauthenticated users, such as guest users.

There are four main steps involved with an identity pool:

1. Authenticate the User: Authenticate the user through Amazon Cognito User Pool, external identity providers, or your own identity provider.
2. Create an Identity: Once authenticated, create an identity for the user in Amazon Cognito.
3. Obtain an OpenID Token: Retrieve an OpenID token from Amazon Cognito.
4. Get Temporary AWS Credentials: Share the OpenID token with Amazon Cognito to receive temporary AWS credentials tokens. Using these credentials, the user can access AWS services or resources based on the assigned IAM roles, as long as the access token remains valid.

Amazon Cognito API for Developers – Identity Pool

Amazon Cognito supports various authentication flows, including basic and enhanced flows. Here’s a look at the enhanced flow:

• GetId: Creates an identity in Amazon Cognito.
• GetCredentialsForIdentity: Retrieves a valid OpenID Connect token, which is then exchanged with AWS Security Token Service (STS). This step provides temporary credentials for accessing other AWS resources.

 Source: Identity Pools (Federated Identities) Authentication Flow

So far, we have seen the usage of Amazon Cognito User Pool for authentication purposes. We then examined the four steps in Amazon Cognito Identity Pool to access other AWS services for authenticated users. We also covered one scenario where both User Pool and Identity Pool are used together as part of the authentication workflow.

As a recap, let us list a few scenarios that could use Amazon Cognito:

• Users can be authenticated with a User Pool in AWS Cognito.
• Users can be authenticated to use server-side resources.
• Users are authorised to use resources with API Gateway and Lambda.
• Users are allowed to use other AWS resources without re-login by combined usage of User Pool and Identity Pool.
• Integrating support for authentication from third-party Identity Providers and social logins.

Amazon Cognito Pool Use Cases

Here is a list of a few more suggested use cases from Amazon Cognito in alignment with what we covered above:

User Pool Use Cases

Web and mobile application developers can use a User Pool when you need to:

• Embed a default sign-up and sign-in page in your client-side applications.
• Avail typical user management features as a proven readily available module.
• Monitor trends in usage and reconstruct sign-in request flows from the perspective of security based on the user device, location, and IP address.
• Build a custom authentication flow based on your specific user management requirements.

Identity Pool Use Cases

Web and mobile application developers can use an Identity Pool when you need to:

• Grant permitted access to your authenticated users to access other AWS resources such as an Amazon Simple Storage Service (Amazon S3) bucket or an Amazon DynamoDB table.
• Grant temporary default access to guest users who are not authenticated.

Needless to say, it also enables us to provide a better user experience as mentioned below:

• Reduce password fatigue from maintaining different username and password combinations.
• Eliminate time spent re-entering passwords for the same identity.
• Lower IT costs due to fewer IT help desk calls about passwords.
• Mitigate risk for access to third-party sites where profile data is not managed and stored securely.
• Gain better control over your online user credentials and identity.
• Speed up the sign-up process at your favourite web applications and services.

I hope you have got an introduction to Amazon Cognito with an overview of major components such as User Pool and Identity Pool with architecture to support various use cases.