AWS re:Invent 2017: [REPEAT] Serverless Authentication and Authorization: Identity M (SRV403-R)

What people said

Recommends Vladimir · 2018-03 · Stack Overflow · on “Using Cognito User Pools, without Cognito Federated Identities(identity pools)”

Based on your comment to Summer Guo, here's what it seems like you're having an issue with... A lot of details missing here, but if you're using a Cognito Authorizer in your API Gateway, then it doesn't know about any 3rd party IdP -- it just knows about your Cognito User Pool. So sending the CUP JWT will work, while sending anything else won't. If you want to use a Google auth token, then you need to implement a Custom Authorizer that verifies this token with Google. I presented on this topic during reInvent. Here's the video that goes into the details: [this video]

Recommends Mehran · 2018-04 · Stack Overflow · on “How to change my web app to use signature v4 for calling API Gateway?”

I've been developing a web app with AWS for a few months now. I'm trying my best to make use of the best practices as much as possible. Going serverless, using API Gateway and Lambda functions, etc. At this point, I have a working web SPA making calls to API Gateway and now I came across the authentication/authorization for my APIs. Learning about Cognito, I came across this nice presentation [this video] on different ways to utilize it for both authentication/authorization. My question is mostly in regard to authorization part. Apparently, there are three ways to implement authorization. And most secure one is signature v4. Putting aside the preparations I need to do on AWS to make this happen,

Recommends jcvalverde · 2018-05 · Stack Overflow · on “How to verify the Signature of a JWT generated by AWS Cognito in Python 3.6?”

I see you're using jose, and I'm using pyjwt, but this solution might help you. Most of the bulk code from the bottom comes from the "api-gateway-authorizer-python" blueprint. Note that this is very frail code that will just break if anything is fails, I ended up not using lambda authentication but rather selecting AWS_IAM authentication for my API Gateway with Identity Pools so I never finished it. This example requires that you install pyjwt and cryptography with pip on your work directory and upload everything as a .zip file. I'd recommend that you watch this video if you want to consider the AWS_IAM authentication option: [this video] They also have a solution with a more elaborate lambda aut

Recommends st.huber · 2022-04 · Stack Overflow · on “AWS API Gateway: Authorize Cognito user groups”

Scopes are not the right thing to use here. Scopes work well if you have different app clients (actual applications using your API Gateway) to limit the scope of what endpoints they can access. They don't work for role based access. As you say, you already use Cognito User Pool and have some user groups setup. A simple apporach would be to use a post confirmation Lambda trigger [LINK] . This Lambda is triggered whenever a new user has been confirmed. It even gets triggered when you use an external identity provider and a user logs in the first time with Cognito hosted UI for instance. In the simplest case you add a user to your 'regular' group with the post confirmation Lambda. For authentic

Cites Michael Du · 2018-05 · Stack Overflow · on “AWS cognito: What's the difference between Access and Identity tokens?”

The weird thing is that in Amazon's conference presentations, they explain that they use the Id_token to retrieve credentials from IAM (despite having all 3)..on multiple occasions so I'm pretty sure it isn't a mistake. [this video] This is the reason why I came looking at this question.

Cites user2203676 · 2018-05 · Stack Overflow · on “Which option to follow for microservices: Spring Boot or AWS Lamba”

After investigation I chose AWS lambdas. My application is a event management application and I want event driven architecture. In general question should have been container vs lambdas and I found a good comparison [LINK] . Starting with Spring is easy because it is so familiar to one with Java background. It is good to write micro services with business logic and exposing as HTTP REST APIs. I was reading domain driven design and it is good to decide micro services size based on boundaries (bounded contexts). But I also see going with Spring boot I will have to manage authentication (for an event management application we need social media login support), authorization, users, roles, polici

Cites Ninad Gaikwad · 2019-08 · Stack Overflow · on “AWS Cognito JWT authentication works with the ID Token, but not the Access Token? Returns 401”

Cognito uses id token to connect to STS and retrieve credentials. So it is the "correct" behavior according to their own conference [this video]

Cites Sprite · 2020-01 · Stack Overflow · on “Alexa account linking - How to id_token instead of access id_token”

True as of Jan 2020 as well. It is contrary to popular convention wherein accessToken is passed in requests for authorization (OAuth) and Id token is used for Identity Authentication(OpenId). On logging in through a Cognito Userpool, we are assigned ID Token, Access Token, and a refresh Token. The ID token is used to communicate with STS and Cognito Federated Identities. The API Gateway authorizer checks only for an ID token will deem the request as UnAuthorized if an accessToken is sent instead of an ID token. AWS explains the data flow between Cognito and Federated Identities in this video: [this video] On linking Alexa with Cognito, when the user logs in the Alexa Skill. Alexa records the acce

Cites Nirav Bhatt · 2020-01 · Stack Overflow · on “How to secure AWS REST back end for mobile access”

I have been reading a lot of AWS Amplify and Cognito docs but seems like there is no direct approach described for this. What I have: I have an iOS app written in Swift and back end is set up in a few lambda functions. I am able to access REST endpoints in the usual way (just like any public URL). As a result, I have no Amplify or AWS SDK integrated in my iOS code. What do I want? 1) Include user management: Allow users to sign up / sign in (this is already there in my back end, but I am open to using Cognito) 2) Secure my back end API so that only authenticated users can access it, through mobile app. (I may use it from Postman for my own development purposes) What I Know: I know there is O

Cites lemming · 2020-04 · Stack Overflow · on “How to Restrict Custom api access using AWS Cognito”

It depends on how much fine-grained control you want over the access to your api. Allow or Deny Scenario In some cases, you either want to block someone completely, or give them access to all of your api. In this all or nothing scenario, the simplest route would be to use Cognito User Pools on their own to authorize your users. Cognito User Pools is just used to authenticate the user (are they who they say they are), and to provide tools to make sign up, and sign in easier. If the user passes authentication, then you can pass one of the tokens returned by cognito user pools (the identity token) to API Gateway. As long as you have set up your api methods to have the Cognito User Pools authori