AWS solutions medium security documentation change
Summary
Updated terminology from 'solution' to 'guidance', restructured workflow steps, removed detailed export/import process descriptions, added CSV mapping file step, and adjusted architecture diagram references.
Security assessment
Removed critical safeguards including the CheckNewUserPool validation (ensuring target user pools are empty during imports) and CheckUserPoolConfig checks (verifying supported configurations). These changes could allow data import into non-empty pools or unsupported configurations, increasing risks of data corruption or misconfiguration if users deviate from guidance.
Diff
diff --git a/solutions/latest/cognito-user-profiles-export-reference-architecture/architecture-overview.md b/solutions/latest/cognito-user-profiles-export-reference-architecture/architecture-overview.md index dc54af022..4cf3484f2 100644 --- a//solutions/latest/cognito-user-profiles-export-reference-architecture/architecture-overview.md +++ b//solutions/latest/cognito-user-profiles-export-reference-architecture/architecture-overview.md @@ -3 +3 @@ -[Documentation](/index.html)[Cognito User Profiles Export Reference Architecture](https://aws.amazon.com/solutions/implementations/cognito-user-profiles-export-reference-architecture)[Implementation Guide](overview.html) +[Documentation](/index.html)[Guidance for User Profiles Export with Amazon Cognito](https://aws.amazon.com/solutions/guidance/user-profiles-export-with-amazon-cognito/)[Implementation Guide](overview.html) @@ -7 +7 @@ -Deploying this solution with the default parameters builds the following environment in the AWS Cloud. +Deploying this guidance with the default parameters builds the following environment in the AWS Cloud. @@ -9 +9 @@ Deploying this solution with the default parameters builds the following environ - + @@ -13 +13 @@ Deploying this solution with the default parameters builds the following environ -The Cognito User Profiles Export Reference Architecture solution automatically deploys an architecture that periodically exports user profiles, groups, and group memberships from an Amazon Cognito user pool in a primary AWS Region to an Amazon DynamoDB global table in the same Region. The use of a global table allows DynamoDB to asynchronously replicate all updates to a backup Region for added resiliency. In the primary Region, a scheduled [Amazon CloudWatch Events](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/WhatIsCloudWatchEvents.html) triggers the `ExportWorkflow` Step Functions workflow that interrogates the primary Amazon Cognito user pool and stores user profiles, groups, and group membership information in the global table. DynamoDB then asynchronously replicates all data to the backup Region. + 1. In the primary AWS Region, an [Amazon CloudWatch](https://aws.amazon.com/cloudwatch/) scheduled [event](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/WhatIsCloudWatchEvents.html) invokes the [AWS Step Functions](https://aws.amazon.com/step-functions/) export workflow, which examines the primary [Amazon Cognito](https://aws.amazon.com/cognito/) user pool. It stores user profiles, groups, and group membership information in the global table. @@ -15 +15 @@ The Cognito User Profiles Export Reference Architecture solution automatically d -This solution’s `ImportWorkflow` Step Functions workflow is used to populate a new, empty Amazon Cognito user pool with data from the global table, allowing you to easily recover user profiles, groups, and group memberships. The `ImportWorkflow` Step Functions workflow can be run in either the primary or backup Region. +_Note: This Guidance does not create the primary user pool._ @@ -17 +17 @@ This solution’s `ImportWorkflow` Step Functions workflow is used to populate a -**Note:** This solution does not create Amazon Cognito user pools on your behalf. When launching the solution, you must supply the ID for the primary user pool. When running the `ImportWorkflow` Step Functions workflow, you must supply the ID of the new user pool. Refer to [Import workflow](./solution-components.html#import-workflow) for more details. + 2. When the export workflow is complete, Step Functions sends a completion or error message to the [Amazon Simple Notification Service (Amazon SNS)](https://aws.amazon.com/sns/) topic for logging or troubleshooting. @@ -19 +19 @@ This solution’s `ImportWorkflow` Step Functions workflow is used to populate a - + 3. [Amazon DynamoDB](https://aws.amazon.com/dynamodb/) asynchronously replicates all data to the backup Region for added resiliency. @@ -21 +21 @@ This solution’s `ImportWorkflow` Step Functions workflow is used to populate a -**Cognito User Profiles Export Reference Architecture export workflow** + 4. In your backup Region, use the same Step Functions import workflow as seen in Step 2 to import data from global table to populate a new, empty Amazon Cognito user pool. This enables you to easily recover user profiles, groups, and group memberships. @@ -23 +23 @@ This solution’s `ImportWorkflow` Step Functions workflow is used to populate a -When `ExportWorkflow` Step Functions workflow initially runs, the `CheckStateMachine` [AWS Lambda](https://aws.amazon.com/lambda/) function ensures that the current run of the `ExportWorkflow` Step Functions workflow is the only one active. If it is found that the `ExportWorkflow` Step Functions workflow is already running, the current run is halted. +_Note: This Guidance does not create the new user pool._ @@ -25 +25 @@ When `ExportWorkflow` Step Functions workflow initially runs, the `CheckStateMac -The `CheckUserPoolConfig` Lambda function analyzes the primary Amazon Cognito user pool and confirms that its configuration is supported by the solution. If an unsupported user pool configuration is detected, the `ExportWorkflow` Step Functions workflow is halted. + 5. A mapping comma-separated values (CSV) file uploads to the guidance's [Amazon Simple Storage Service (Amazon S3)](https://aws.amazon.com/s3/) bucket. This CSV file maps the line number reported by Amazon Cognito to the subattribute of the corresponding users for inclusion in the troubleshooting error message. @@ -27 +27 @@ The `CheckUserPoolConfig` Lambda function analyzes the primary Amazon Cognito us -The `SyncUsers` Lambda function calls the [ListUsers API](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsers.html) for the primary user pool. Each user is exported to the solution’s backup table (`BackupTable` DynamoDB global table). After users are exported, the `ListGroups` Lambda function calls the [ListGroups API](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListGroups.html) for the primary user pool. The `SyncGroup` Lambda function places a record in the `BackupTable` DynamoDB table for each group and the `SyncUsersInGroup` Lambda function uses the [ListUsersInGroup API](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsersInGroup.html) to retrieve the users in that group and sync group memberships to the `BackupTable` DynamoDB table. + 6. When the import workflow is complete, Step Functions sends a completion or error message to an Amazon SNS topic for logging or troubleshooting. @@ -29 +28,0 @@ The `SyncUsers` Lambda function calls the [ListUsers API](https://docs.aws.amazo -When the data has been synced to the `BackupTable` DynamoDB table, the `BackupTableCleanup` Lambda function checks the `BackupTable` DynamoDB table for any items that were not updated in the current `ExportWorkflow` Step Functions workflow run. These items are added to the `ImportWorkflow` Step Functions workflow’s [Amazon Simple Queue Service](https://aws.amazon.com/sqs/) (Amazon SQS) queue. After the `BackupTable` DynamoDB table is checked, the `BackupTableCleanup` Lambda function drains the SQS queue and removes these items from the `BackupTable` DynamoDB table. @@ -31 +29,0 @@ When the data has been synced to the `BackupTable` DynamoDB table, the `BackupTa -When the `ExportWorkflow` Step Functions workflow is complete, the `MessageBroker` Lambda function sends a completion message to the solution’s [Amazon Simple Notification Service](https://aws.amazon.com/sns/) (Amazon SNS) topic. If the workflow’s Lambda functions generate any errors, they will be caught and forwarded to the `MessageBroker` Lambda function to publish an error message to the solution’s Amazon SNS topic. @@ -33,15 +30,0 @@ When the `ExportWorkflow` Step Functions workflow is complete, the `MessageBroke - - -**Cognito User Profiles Export Reference Architecture import workflow** - -When the `ImportWorkflow` Step Functions workflow initially runs, the `CheckStateMachine` Lambda function ensures ImportWorkflow is not already running. If the `ImportWorkflow` Step Functions workflow is already running, the current run is halted. The `CheckNewUserPool` Lambda function ensures that the Amazon Cognito user pool that was supplied to the new Amazon Cognito user pool is empty (has no users or groups). - -The `ScanTable` Lambda function scans all items in the `BackupTable` DynamoDB table. If an item representing a group in the primary user pool is returned, that group is created in the new user pool. Items representing users in the primary user pool is added to the `NewUsers` Amazon SQS queue and items representing group memberships or users that are not enabled in the primary user pool is added to the `Update` Amazon SQS queue. - -The `ImportUsers` Lambda function drains the `NewUsers` Amazon SQS queue, creates a CSV file with the users, and creates and runs a job to import those users to the new user pool. For details, refer to [Importing Users into User Pools From a CSV File](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool.html). - -The Cognito user import job reports its progress in Amazon CloudWatch. For details, refer to [Viewing the User Pool Import Results in the CloudWatch Console](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool-cloudwatch.html). In the event a user is not imported, you will see a `FAILED` message in the CloudWatch logs for the job along with the corresponding line number from the user import CSV and reason for the failure. When the solution starts the user import job, a mapping file uploads to the solution’s [Amazon S3](https://aws.amazon.com/s3/) bucket. The mapping file is a CSV file with two columns: a line number and a user’s `sub` attribute from the primary user pool. This mapping file is used to troubleshoot failed user imports by cross-referencing the line number reported by Cognito and the `sub` of the corresponding user. - -Once all users have been imported and the `NewUsers` Amazon SQS queue is emptied, the `UpdateUsers` Lambda function drains the `Update` Amazon SQS queue and adds users to the groups where they belong. If any users were not enabled in the primary user pool, the `UpdateUsers` Lambda function will update them accordingly in the new user pool. - -When the `ImportWorkflow` Step Functions workflow is complete, the `MessageBroker` Lambda function sends a completion message to the solution’s SNS topic. If the workflow’s Lambda functions generate errors, they will be forwarded to the `MessageBroker` Lambda function to publish an error message to the solution’s SNS topic. @@ -57 +40 @@ Cost -Solution components +Guidance components