AWS solutions medium security documentation change
Summary
Updated Cognito callback URL configuration guidance with clearer instructions and added link to Auth Setup README
Security assessment
Addresses misconfiguration of Cognito callback URLs which could lead to authentication failures or security vulnerabilities like open redirects. Provides explicit security configuration guidance.
Diff
diff --git a/solutions/latest/connected-mobility-solution-on-aws/troubleshooting.md b/solutions/latest/connected-mobility-solution-on-aws/troubleshooting.md index a845e8b30..f93b915fc 100644 --- a/solutions/latest/connected-mobility-solution-on-aws/troubleshooting.md +++ b/solutions/latest/connected-mobility-solution-on-aws/troubleshooting.md @@ -43 +43 @@ Delete all `ProvisionedVehicles` table records for the invalid VIN, and reprovis -When the auth-setup module is deployed it deploys a Cognito instance it requires a callback URL. If not provided it takes the default value of [https://example.com](https://example.com) causing Cognito to deny redirection to user’s actual callback URL. +When the auth-setup module is deployed using Cognito, it includes a user app client with an allowed list of Callback URLs. If not provided it takes the default value of [https://example.com](https://example.com). The appropriate callback URLs are necessary to properly sign-in to the Backstage portal. If not configured properly, the redirect, and login attempt, will fail. @@ -47 +47 @@ When the auth-setup module is deployed it deploys a Cognito instance it requires -Log in to AWS console, and change callback URL by visiting the Cognito instance deployed by Auth-Setup module. +Log in to AWS console and navigate to Cognito. Locate the cms-users app client, and assess the Callback URLs. Ensure your backstage domain is included with the pre-configured URL expected by Backstage. For more details, see the [Auth Setup README](https://github.com/aws-solutions/connected-mobility-solution-on-aws/blob/main/source/modules/auth_setup/README.md#integration-with-acdp%E2%80%94%E2%80%8Bbackstage).