User Authentication (Signup & Login) on AWS with Lambda, Cognito or IAM

Question

I've been looking to use various AWS services to handle the infrastructure for our next major project. We started looking at docker containers on EC2 instances, but after looking into AWS Lambda a bit more - it seems like a worthy path to explore.

Using the AWS Lambda paradigm, we would simply use Lambda functions as the logical glue to hold our data and events (from other AWS services) together.

For instance, if a user of our product creates a new record, AWS Lambda can be triggered on that event and we can call a lambda function to add that record to AWS Cloudsearch, thus keeping our search up to date.

I'm a little uncertain when it comes to user management, authentication and so on within this type of paradigm. I've read some documentation on IAM and Cognito in looking for an AWS service to offload user sign up, login, logout, forgot password, etc to. It doesn't seem like that's what these services are actually for. IAM is identity management for the organization (not the user base), and cognito is more focused on syncing identity information across many devices or app instances (post authentication).

I'm currently wondering if what I should be doing is writing sign up, login, forgot password etc code as lambda functions myself? or is there some solution or set of solutions within the AWS stack that would scratch this particular itch?

Answer 1

You can use your own authentication system with Cognito and then use IAM for authorisation, even for your user base.

• When authenticating a user (possibly in a Lambda function called via API Gateway), you will retrieve or create in Cognito an identity ID associated to the user using GetOpenIdTokenForDeveloperIdentity.
• Then you will have a Cognito OpenId token that you can give to your authenticated user.
• The user can use this token to get temporary AWS credentials associated with an IAM role. So you can give access to some of your AWS resources for authenticated users: GetCredentialsForIdentity.
• When the user calls AWS resources using these credentials, you have access to his Cognito identity via the context (examples with Lambda, API Gateway or S3)
• Finally, you can find the user associated to this Cognito identity in your system using LookupDeveloperIdentity.

Check the authentication flow and some more examples