Cognito

Question 1

What are some keywords that indicate Cognito should be used and not IAM?

Answer 1

• Hundreds of users
• Mobile users
• Authenticate with SAML

Question 2

What is the difference between Cognito and IAM?

Answer 2

Cognito is to provide external users an identity to interact with a web or mobile application

Question 3

What is the purpose of Cognito Identity Pools?

Answer 3

Provide temporary AWS credentials to users to they can access AWS resources directly
- Integrate with Cognito User Pools as an Identity Provider

Question 4

Describe the two main paths of access via Cognito User Pools (CUP)

Answer 4

On login the user receives a JWT - JSON Web Token. The JWT is passed to API Gateway (which then evaluates the token against CUP), and then provides backend access.

The second flow is similar to above, except an ALB authenticates the user against CUP, and then forwards the user to the backend.

Question 5

What is it called when users are allowed to log in using Google, Facebook etc.?

Answer 5

Federation through Third Party Identity Provider (IdP)

Question 6

How can you create a hosted UI custom domain?

Answer 6

For a custom domain, you must create an ACM certificate in us-east-1, and define the domain within the ‘App integration’ section

Question 7

What is adaptive authentication?

Answer 7

Block sign-ins or require MFA if the login appears suspicious

Question 8

How can you authenticate users with an ALB?

Answer 8

Load balancer authenticates users either through an IdP (that is OpenID Connect compliant), or through Cognito User Pools (federated such as Facebook, Google or corporate identities such as SAML)
-> Must use an HTTPS listener to set authenticate-oidc & authenticate-cognito rules

Question 9

What is a basic flow for getting AWS access via Cognito Identity Pools?

Answer 9

1. Login and get token (using an IdP or CUP)
2. Exchange token with Cognito Identity Pools (token is validated against IdP or CUP)
3. If validation successful, Cognito Identity Pools gets temp credentials from STS (security token service) and passes these back to application

Question 10

How do you control IAM access for users with Cognito Identity Pools?

Answer 10

Define default IAM roles for authenticated and guest users
- Define rules to choose the role for each user based on the User’s ID
- Can define a policy variable on an AWS resource to provide access only under certain conditions (e.g., an S3 bucket that has a prefix of the user’s ID)

Question 11

What is the difference between Cognito User Pools vs Identity Pools?

Answer 11

• CUP is for authentication, i.e., identity verification
• CIP is for authorization, i.e., access control