Is it safe to show the AWS cognito pool ID in my html?

Question

I am building a serverless website with AWS Cognito, Lambda, S3 and a dozen more of their services. My HTML/JS in my login page has the cognito pool ID. How safe is this? I know that it is best practise to hide sensitive stuff. But this is not client-server. Its all client if im honest. I do access some sensitive data via a lambda call. But even this call requires some plain-text sensitive inputs like the user ID.

    <script src="https://sdk.amazonaws.com/js/aws-sdk-2.3.7.min.js">   </script>
    <script>
    AWS.config.region = 'XX-XXXX-1';
    AWS.config.credentials = new AWS.CognitoIdentityCredentials({
    IdentityPoolId: 'XX-XXXX-1:XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX'
    });
    var lambda = new AWS.Lambda();
    </script>

I really dont like the poolID visible. An attacker can copy this and brute force my cognito IDs. Any ideas to hide it?

Answer 1

Using the identity pool id to create the client is a requirement, and keeping it client side is very common. It isn't a major risk on it's own, and what there is can be greatly limited with a bit of tinkering on your side.

You can mitigate the risk of exposing the identity pool id via the roles that Cognito creates and links to the pool. Through those, you can scope down the credentials that Cognito will generate for your unauthenticated/authenticated users. This blog post has more on how to do this. You could take that a step further by greatly limiting the privileges of unauthenticated users until they have logged into an authenticated identity.

Answer 2

You can put the Pool and other Cognito IDs in your HTML without much fear (if you've defined the unauthorized policies carefully), but you may want to use API Gateway (with built-in Cognito authorizer) for handling calls to other back-end services (like DynamoDB or S3) instead of using those directly from the front-end js. That's described here:

https://aws.amazon.com/blogs/mobile/aws-mobile-app-backend-with-hybrid-apps/