Overview
Cognito gives users an identity to interact with a web and mobile application. These users usually sit outside your AWS account, hence the name: it gives an identity to users you do not know yet.
Two sub-services:
- Cognito User Pools: sign-in functionality for app users, with good integration with API Gateway and the Application Load Balancer.
- Cognito Identity Pools (formerly Federated Identity): provide temporary AWS credentials to users registered with your application so they can access AWS resources directly.
Don't we already have users in IAM? Yes, but Cognito is for your web and mobile application users who sit outside AWS. Exam keywords: hundreds of users, mobile users, authentication with SAML and similar mechanisms.
Cognito User Pools (CUP) vs Identity Pools
| Feature | User Pools | Identity Pools (Federated Identities) |
|---|---|---|
| Purpose | Sign-in / serverless user database for web and mobile apps | Get temporary AWS credentials for direct access to AWS |
| Integrates with | API Gateway, Application Load Balancer | Direct AWS access (S3, DynamoDB) or through API Gateway |
| User source | Its own user database (username or email + password) | Cognito User Pools users or third-party logins |
Cognito User Pools vs Identity Pools
User Pools Details
- Serverless database of users for web and mobile apps.
- Simple login: username (or email) plus password.
User pools now have feature plans: Lite, Essentials and Plus. The course predates them. AWS source
- Password reset.
- Email and phone number verification.
- Multi-factor authentication (MFA).
- Federated identities login with Facebook, Google and so on.
Integration with API Gateway
- The user connects to the Cognito User Pool and retrieves a token.
- The user passes the token to API Gateway.
- API Gateway verifies it and, if good, translates it to the user identity.
- The identity is passed to the Lambda backend, which knows exactly which authenticated user it deals with.
Integration with Application Load Balancer
- The application authenticates against the Cognito User Pool.
- The ALB verifies the login. If valid, it redirects the request to the backend with additional headers carrying the user identity.
The responsibility of verifying login moves from the backend to the API Gateway or ALB.
Identity Pools Details
- Users access your AWS account directly using temporary AWS credentials, not through API Gateway or ALB (though API Gateway is possible).
- User sources: Cognito User Pools users, or third-party logins (social, SAML, OpenID Connect).
- The IAM policies for the credentials are defined in the Identity Pool service, and can be customized based on user ID for fine-grained control.
- A default IAM role can be set: guest users, or authenticated users without a specific role, inherit it.
Flow (web/mobile app accessing S3 or DynamoDB)
- The app logs in (Cognito User Pools, social identity provider, SAML, OpenID Connect) and gets a token.
- It passes the token to the Cognito Identity Pool to exchange it for temporary AWS credentials.
- The Identity Pool validates the token (login valid) and crafts an IAM policy specific to the user.
- The app uses the credentials to access the S3 bucket or DynamoDB table directly.
Row-Level Security in DynamoDB
The policy from the Identity Pool includes a condition that the leading key for DynamoDB must equal the Cognito identity user ID. The user cannot read and write all items, only the items they have access to. See 09-Amazon-DynamoDB.
- Create a user base for web and mobile applications.
- Enable row-level security in DynamoDB for fine-grained access.
- Remember the integration between Cognito User Pools and API Gateway / ALB.
Questions & Answers
Q1: User Pools or Identity Pools?
Answer:
User Pools authenticate app users (sign-in, MFA, social login) and integrate with API Gateway and ALB. Identity Pools exchange a token for temporary AWS credentials for direct AWS access.
Q2: Why not IAM users for mobile app users?
Answer:
IAM is for AWS account identities. Cognito is for web and mobile application users outside AWS (hundreds of users, SAML, social logins).
Q3: How do you give each user access to only their DynamoDB items?
Answer:
Identity Pool IAM policy with a condition that the DynamoDB leading key equals the Cognito identity user ID.
Q4: How do you make API Gateway or an ALB verify user logins?
Answer:
Integrate with a Cognito User Pool. The user gets a token, API Gateway or the ALB verifies it and passes the user identity to the backend.
Q5: What was Identity Pools' old name?
Answer:
Federated Identity.
Check yourself
Quiz
Flashcards
Click the card (or focus it), then use ← → to move and Space to flip.