Skip to main content

Amazon Cognito Integration

The Corsha mIDP integrates with Amazon Cognito to automatically import and synchronize user pool clients and identity pool identities as machine identities. This integration enables organizations to leverage AWS's authentication and authorization service while applying Corsha's zero-trust access controls.

Overview​

Amazon Cognito provides authentication, authorization, and user management for web and mobile applications. The Corsha integration imports Cognito user pool clients and identity pool federated identities into the mIDP, creating machine identities that can be organized into groups and protected with connection rules and protocol enforcement policies.

Key Benefits:

  • Automated Identity Import: Cognito user pool clients and identity pool identities are automatically imported as machine identities
  • Continuous Synchronization: Identity information remains current as Cognito detects changes
  • Multi-Region Support: Support for Cognito user pools across multiple AWS regions
  • OAuth 2.0 and OIDC Integration: Leverage Cognito's OAuth 2.0 and OpenID Connect support
  • AWS-Native Integration: Seamless integration with AWS authentication infrastructure

Identity Information Imported​

The following information is imported from Amazon Cognito:

  • User Pool Client Details: Client ID, client name, user pool ID
  • Identity Pool Information: Identity pool ID, identity provider details
  • Authentication Configuration: OAuth 2.0 flows, allowed scopes, callback URLs
  • AWS Metadata: AWS region, account ID, resource tags
  • Token Configuration: Access token expiration, refresh token expiration
  • Provider Attributes: Federated identity provider mappings
  • Last Activity: Most recent authentication timestamp

Use Cases​

AWS Application Access Control​

Control access between AWS-hosted applications and services:

  • Import Lambda function Cognito client IDs as machine identities
  • Create connection rules for API Gateway to Lambda communication
  • Apply protocol enforcement to containerized AWS applications
  • Monitor API calls between AWS services using Cognito authentication

Mobile and Web Application Backend Security​

Secure backend services for mobile and web applications:

  • Import mobile app Cognito clients as machine identities
  • Control access from authenticated apps to backend APIs
  • Apply connection rules based on OAuth scopes
  • Monitor application-to-service communication patterns

Federated Identity Management​

Manage federated identities across identity providers:

  • Import federated identities from social providers (Google, Facebook, Amazon)
  • Import identities from enterprise SAML providers
  • Maintain consistent policies across identity sources
  • Centralize visibility of federated machine access

Configuration​

Adding Amazon Cognito Connection​

Step 1: Access Cloud Identity Sources​

  1. Navigate to the Identity Sources page in the Corsha Console
  2. Scroll down to the Cloud Identity Sources section
  3. Click the New Connection button in the upper-right corner

Step 2: Select Amazon Cognito​

A dialog will appear prompting you to select your cloud identity provider. Click the + button below Amazon Cognito to configure AWS Cognito User Pool integration.

Step 3: Provide Connection Details​

Fill in the following required fields:

  • User Pool ARN* (required): The Amazon Resource Name (ARN) of your Cognito User Pool
    • Format: arn:aws:cognito-idp:REGION:ACCOUNT_ID:userpool/POOL_ID
    • Find in AWS Console: Amazon Cognito > User pools > Select pool > User pool overview > User pool ARN
  • Access Key ID* (required): AWS IAM access key with permissions to read Cognito User Pool
    • Create in AWS Console: IAM > Users > Your user > Security credentials > Create access key
  • Secret Access Key* (required): The secret key associated with your AWS access key
    • Provided when creating the access key (store securely, shown only once)
  • IAM Role ARN* (required): The ARN of the IAM role that Corsha will assume to access your User Pool
    • Format: arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME
    • Create in AWS Console: IAM > Roles > Create role

Step 4: Configure IAM Permissions​

The IAM role or user requires the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cognito-idp:DescribeUserPool",
        "cognito-idp:DescribeUserPoolClient",
        "cognito-idp:ListUserPoolClients",
        "cognito-identity:DescribeIdentityPool",
        "cognito-identity:ListIdentityPools"
      ],
      "Resource": "*"
    }
  ]
}

To create this IAM policy:

  1. Navigate to IAM > Policies > Create policy
  2. Switch to the JSON tab and paste the policy above
  3. Name the policy (e.g., "CorshaCogitoReadOnly")
  4. Attach the policy to your IAM user or role

Step 5: Complete the Connection​

  1. Fill in all required fields with your AWS Cognito credentials
  2. Click Test Connection to verify the configuration
  3. If successful, save the connection to begin syncing machine identities
  4. Configure synchronization frequency and attribute mapping
  5. Specify default machine group assignments for imported identities
Configuration Access

Contact your Corsha Technical Point of Contact (TPOC) for assistance configuring the Amazon Cognito integration and obtaining necessary AWS credentials.

Supported Amazon Cognito Versions​

The Corsha integration supports Amazon Cognito User Pools and Identity Pools via AWS SDK and Cognito APIs.

Next Steps​