Amazon Cognito - Developer Guide - AWS Documentation

1 Amazon CognitoDeveloper GuideAmazon Cognito Developer GuideAmazon Cognito : Developer GuideCopyright 2019 Amazon Web Services, Inc. and/or its affiliates. All rights 's trademarks and trade dress may not be used in connection with any product or service that is not Amazon 's, in any mannerthat is likely to cause confusion among customers, or in any manner that disparages or discredits Amazon . All other trademarks notowned by Amazon are the property of their respective owners, who may or may not be affiliated with, connected to, or sponsored Cognito Developer GuideTable of ContentsWhat Is Amazon Cognito ? .. 1 Features of Amazon Cognito .

2 2 Getting Started with Amazon Cognito .. 2 Pricing for Amazon Cognito .. 3 Using the Amazon Cognito Console .. 3 Regional Data Considerations .. 4 Getting Started with Amazon Cognito .. 5 Common Amazon Cognito Scenarios .. 6 Authenticate with a User Pool .. 6 Access Your Server-side Resources .. 6 Access Resources with API Gateway and Lambda .. 7 Access AWS Services with a User Pool and an Identity Pool .. 8 Authenticate with a Third Party and Access AWS Services with an Identity Pool .. 8 Access AWS AppSync Resources with Amazon Cognito .. 9 Tutorials .. 10 Creating a User Pool .. 10 Related Resources .. 10 Creating an Identity Pool.

3 10 Related Resources .. 11 Cleaning Up Your AWS Resources .. 11 Adding a Web or Mobile App to a User Pool .. 11 Amazon Cognito User Pools .. 13 Getting Started with User Pools .. 14 Prerequisite: Sign Up for an AWS Account .. 14 Step 1. Create a User Directory with a User Pool .. 14 Step 2. Add an App to Enable the Hosted Web UI .. 15 Step 3. Add Social Sign-in to a User Pool (Optional) .. 17 Step 4. Add Sign-in with a SAML Identity Provider to a User Pool (Optional) .. 20 Step 5. Install an Amazon Cognito User Pools SDK .. 22 Next Steps .. 23 Adding a Web or Mobile App .. 23 Adding a JavaScript App .. 24 Adding an Android App.

4 39 Adding an iOS App .. 59 Using the Hosted 74 Adding an App Client (AWS Management Console) .. 74 Configuring an App 76 Configuring a 80 Customizing the Built-in Webpages .. 85 Defining Resource Servers .. 88 Adding Sign-in Through a Third Party .. 90 Adding Social Identity Providers .. 91 Adding SAML Providers .. 95 Adding OIDC Providers .. 102 Specifying Attribute Mappings .. 107 Managing Security .. 110 Adding Multi-Factor Authentication (MFA) .. 110 Adding Advanced Security .. 113 Using Lambda Triggers .. 121 Using Lambda Triggers .. 122 User Pool Lambda Trigger Event .. 122 User Pool Lambda Trigger Common Parameters.

5 123 Lambda Trigger Sources .. 123 Pre Sign-up Lambda Trigger .. 125iiiAmazon Cognito Developer GuidePost Confirmation Lambda Trigger .. 130 Pre Authentication Lambda Trigger .. 133 Post Authentication Lambda Trigger .. 136 Challenge Lambda Triggers .. 139 Pre Token Generation Lambda Trigger .. 147 Migrate User Lambda Trigger .. 151 Custom Message Lambda Trigger .. 154 Using Amazon Pinpoint Analytics .. 158 Using Amazon Pinpoint Analytics .. 158 Specifying Amazon Pinpoint Analytics Settings (AWS CLI and AWS API) .. 159 Managing 159 Signing Up and Confirming User Accounts .. 160 Creating Users as Administrator .. 167 Adding Groups to a User Pool.

6 170 Managing and Searching for Users .. 172 Importing Users into a User Pool .. 186 User Pool Authentication Flow .. 187 Using Tokens .. 191 Accessing Resources after Sign-in .. 198 Accessing Server-side Resources .. 6 Accessing Resources with API Gateway and Lambda .. 199 Accessing AWS Resources Using an Identity Pool .. 200 User Pools Console Reference .. 202 User Pool Name .. 204 Users and groups .. 204 Attributes .. 204 Password Requirements .. 210 Admin Create User Policy .. 210 Email or Phone Verification .. 211 Message 212 Tags .. 214 Devices .. 215 App 216 Triggers .. 217 Review Settings .. 217 Analytics.

7 217 App Client Settings .. 218 Domain 218UI 219 Resource Servers .. 219 Identity Providers .. 220 Attribute Mapping .. 223 Amazon Cognito Identity Pools .. 224 Getting Started with Identity Pools .. 224 Sign Up for an AWS Account .. 225 Create an Identity Pool in Amazon Cognito .. 225 Install the Mobile or JavaScript SDK .. 225 Integrate the Identity Providers .. 226 Get Credentials .. 226 Using Identity Pools .. 226 User IAM Roles .. 227 Authenticated and Unauthenticated 227 Enable or disable unauthenticated 227 Change the role associated with an identity type .. 227 Enable or edit authentication providers.

8 228 Delete an Identity Pool .. 228ivAmazon Cognito Developer GuideDelete an Identity from an Identity Pool .. 229 Managing 229 Bulk Publish 230 Enable Push Synchronization .. 230 Set Up Amazon Cognito Streams .. 230 Set Up Amazon Cognito Events .. 230 Identity Pools Concepts .. 230 Identity Pools Authentication Flow .. 231 IAM Roles .. 235 Role Trust and Permissions .. 239 Role-Based Access Control .. 239 Creating Roles for Role Mapping .. 240 Granting Pass Role Permission .. 240 Using Tokens to Assign Roles to Users .. 241 Using Rule-Based Mapping to Assign Roles to Users .. 241 Token Claims to Use in Rule-Based Mapping.

9 242 Best Practices for Role-Based Access Control .. 243 Getting Credentials .. 243 Android .. 243iOS - Objective-C .. 244iOS - Swift .. 245 JavaScript .. 246 Unity .. 248 Accessing AWS Services .. 249 Android .. 249iOS - Objective-C .. 249iOS - Swift .. 249 JavaScript .. 250 Unity .. 250 Identity Pools External Identity Providers .. 250 Facebook .. 251 Login with Amazon .. 259 Open ID Connect Providers .. 265 SAML Identity Providers .. 267 Developer Authenticated Identities .. 268 Understanding the Authentication Flow .. 269 Define a Developer Provider Name and Associate it with an Identity Pool .. 269 Implement an Identity Provider.

10 269 Updating the Logins Map (Android and iOS only) .. 275 Getting a Token (Server Side) .. 275 Connect to an Existing Social Identity .. 276 Supporting Transition Between Providers .. 277 Switching Identities .. 279 Android .. 279iOS - Objective-C .. 280iOS - Swift .. 280 JavaScript .. 280 Unity .. 281 Amazon Cognito Sync .. 282 Getting Started with Amazon Cognito Sync .. 282 Sign Up for an AWS Account .. 282 Set Up an Identity Pool in Amazon Cognito .. 283 Store and Sync Data .. 283vAmazon Cognito Developer GuideSynchronizing Data .. 283 Initializing the Amazon Cognito Sync Client .. 283 Understanding 285 Reading and Writing Data in Datasets.