# Cognito

## Icon

![Cognito](https://icon.icepanel.io/AWS/svg/Security-Identity-Compliance/Cognito.svg)

## About

* This service give users an identity to interact with web or mobile application.
* There are two services as part of this offering.

### Cognito User Pool

* Provides sign in functionality to users.
* It is used authentication.
* Integrates with Application Load Balancer _(ALB)_ and API gateway.
* It is a serverless database of users.
* It provides following functionality and more,
  * Handles simple login flows like username/email and password
  * Federated Identity users from Google, Fb, SAML, OIDC etc
  * MFA
  * Password rest
  * Email and Phone number verification
  * Blocks users if credentials are compromised
* Provides synchronous lambda triggers for signup, signin, messaging etc.
* A Login sends back a [JWT](https://jwt.io/introduction) token.

#### Lambda Triggers

* The list of operation and lambda triggers are summorized in the table [here](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#w117aac21c23c13).

#### Hosted Authentication UI

* This hosted UI provided by Cognito allows to handle both `sign-up` and `sign-in` flows.
* Customization of logos and styling is possible for this hosted UI.

**Custom Domain**

* If a custom domain is created for hosted UI, the certificate should be hosted in ACM at `us-east-1` region only.
* This custom domain must be defined in App Integration section of Cognito.

#### Adaptive Authentication

* This feature blocks user signin or requires MFA if the authentication appears suspicious.
* This is achieved by calculating a risk score _(based on location, IP and device used)_ for each sign-in attempt.
* CloudWatch logs integration allows to monitor the authentication attempts trail.

#### Typical Flow

![CUP Flow](https://574639531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJDnjsv52I3fJ56WbLgHu%2Fuploads%2Fgit-blob-ef8347bda1eb62826b5d6316d159780dae97eaa5%2FCUP_Flow.png?alt=media)

#### Integrations

![Integration](https://574639531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJDnjsv52I3fJ56WbLgHu%2Fuploads%2Fgit-blob-8d733fd7383ebfe8c62942816063423713f372f5%2FCUP_Integrations.png?alt=media)

**ALB**

* ALB integration allows to offload the authentication process from application to the ALB.
* Authentication can be done using
  * OpenID Connect
  * Cognito User Pool
  * SAML/LDAP/Microsoft AD
* This require `HTTPS` listener to set authenticate-oidc or authenticate-cognito rules.

**Flow Diagram**

* Cognito Integration flow ![CUP ALB](https://574639531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJDnjsv52I3fJ56WbLgHu%2Fuploads%2Fgit-blob-771f9639867c3d19fc9665b840b0b6038a667ac4%2FCUP_ALB_Cognito.png?alt=media)
* OpenId connect Integration flow ![CUP ALB OpenID Connect](https://574639531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJDnjsv52I3fJ56WbLgHu%2Fuploads%2Fgit-blob-12dd71f5261e85d607588f207f16b60662b585ae%2FCUP_ALB_Open_ID_Connect.png?alt=media)

### Cognito Identity Pool

* Also known as Federated Identity.
* It is used for authorization _(access control)_.
* It provides AWS credentials to outside users _(i.e app/web users not part of AWS IAM)_ so that they can access AWS resources directly.
* CIP provides temporary credentials to app/web users or guest _(unauthenticated)_ user.
* It also integrates with Cognito User Pool _(CUP)_, OpenID Connect, SAML, custom login servers or public Identity providers _(IdP)_ as an identity provider.
* Once the temporary credentials are obtained, users can access the AWS resources directly or via API gateway.

#### Flow Diagram

![CIP Flow](https://574639531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJDnjsv52I3fJ56WbLgHu%2Fuploads%2Fgit-blob-cc60e9f7a062b86fedcc395083befdebff2ec760%2FCIP_Flow.png?alt=media)

#### Sample Policy

![CIP Guest Policy](https://574639531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJDnjsv52I3fJ56WbLgHu%2Fuploads%2Fgit-blob-6c045c630db5b24ea26fb8ac7733309aa81a2987%2FCIP_Guest_AccessPolicy.png?alt=media)

![CIP S3 Policy](https://574639531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJDnjsv52I3fJ56WbLgHu%2Fuploads%2Fgit-blob-c73da62072a3195e7c39dbd003de4280449e2d6c%2FCIP_S3_AccessPolicy.png?alt=media)

![CIP DynamoDB Policy](https://574639531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJDnjsv52I3fJ56WbLgHu%2Fuploads%2Fgit-blob-70d4cfdf2b63c6e3661b5c079bd588f66aa0b0a0%2FCIP_DynamoDB_AccessPolicy.png?alt=media)
