How can I group AWS Cognito users based on a team or organization?

Question

I want to create a service which allows users to sign up, but these users can be part of a team or organization; just like any other service, e.g. Slack, Trello, Google Apps, etc. So these users will need to inherit settings and permissions from the parent team or organization they have signed up as part of.

I understand there are user groups in Cognito, but these are limited to 25 per user pool as per the limits, and there is a limit of 60 pools by default. Is this even the correct way, or is there a better way to do this? Specifically is there a built in mechanism in Cognito to deal with this issue or will it require some additional work?

Thanks in advance.

Answer 1

To implement multi-tenant (teams, groups, organizations) support for your application, separating them as Cognito groups isn't the right choice.

You can either provision a Userpool per tenant (you can request to increase the limit from 60 by sending a limit increase support request to AWS) or handle tenants at the application level using a single Userpool (using Cognito only to authenticate).

Note: Unless you are using separate subdomains (e.g tenant1.xyz.com) for each tenant with their own custom login page icon, you can use a single Cognito Userpool approach which is simpler.

After a user authenticates using Cognito login page, you can use the Cognito pre token generation trigger Lambda to query user's Tenant ID from the database and add it to the JWT token so that upon verification of the token, you can retrieve the Tenant ID of the logged in user.