CODEWITHSUNDEEP
amazon-web-servicesamazon-cognito
Itay Maman
Itay Maman

Reputation: 30733

AWS cognito: allowing only a certain users (identities) to get credentials

My production environment uses AWS cognito federated identities (AKA: identity pool) for allowing users to sign in with their Google/FB accounts. This is working fine.

However, for my staging environment I want to offer a similar sign in functionality (that is: users sign in in via Google) but I want to restrict the ability to sign in only to a specific whitelist (of, say, @gmail.com accounts). This is because the staging environment should only be accessed by team members and a bunch of trusted users.

My question is this: is it possible to define a Cognito identity pool that allows only the whitelisted users to sign in? if the answer is "yes", then how?

I know that I can do the whitelist checking at my backend (that is: at the backend of my staging env. I will reject every request not coming from these whitelisted users) but this is a bit unclean. In particular, I want the rejection to happen as early and possible and, ideally, to be carried out by cognito itself, and not by my backend.

Clarifications:

Upvotes: 2

Views: 2833

Answers (2)

Pablo Salazar
Pablo Salazar

Reputation: 957

You can invoke a trigger and execute a lambda function when the user submits their information to accept or deny the sign in request.

enter image description here

Upvotes: 0

KiteCoder
KiteCoder

Reputation: 2450

The purpose of the Identity pool is to provide access to authenticated identities. Therefore, this resource cannot manage users (ie: white listing a user group).

There are two ways to do this:

  1. Link 3rd Party Identity into a User Pool and white list by User Group. Your user group will have a Roles and permission it will assume that will allow your test users to have the functionality they need without allowing other users who log to have that functionality.

  2. Manage users from the 3rd Party Identity - I am not an expert at Google authentication.. but some OpenID providers allow you to create user groups with different access roles. This is an example for Google.

Upvotes: 1

Related Questions