AWS Cognito: Restrict users to a single domain

Question

I'm using cognito federated login with google as identity provider. The requirement is to only allow the users of my company (with domain as [email protected]).

Any ideas on how and where to configure such rules would be much appreciated. Or kindly point me to the right documentation.

Thank you,

Answer 1

I was able to achieve that with pre-signup lambda trigger, couldn't find a way to restrict access using configuration only.

This is my lambda function code

exports.handler = (event, context, callback) => {
    console.log ("Trigger function =", event.triggerSource);

    // Send post authentication data to Cloudwatch logs
    if (event.request.userAttributes.email.endsWith('@mydomain.com')) {
            console.log ("Authentication successful: ", event.request);
            callback(null, event);
    } else {
        console.log ("Authentication failed: ", event.request);
        callback("can't connect to admin", event)
    }

};