AWS cognito documentation change
Summary
Updated documentation to reflect transition from Amazon SNS to AWS End User Messaging SMS for SMS delivery, including service references, pricing links, sandbox procedures, MFA/OTP email support, and IAM permission requirements.
Security assessment
The changes document the migration to AWS End User Messaging SMS and clarify required IAM permissions (sns:Publish). They add email as an MFA/OTP option (security feature) requiring specific feature plans and SES configuration. While these updates improve clarity and expand security features, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/cognito/latest/developerguide/user-pool-sms-settings.md b/cognito/latest/developerguide/user-pool-sms-settings.md index 047763e50..2e9c3aead 100644 --- a//cognito/latest/developerguide/user-pool-sms-settings.md +++ b//cognito/latest/developerguide/user-pool-sms-settings.md @@ -11 +11 @@ Some Amazon Cognito events for your user pool might cause Amazon Cognito to send -Amazon Cognito uses Amazon Simple Notification Service (Amazon SNS) for delivery of SMS text messages. If you are sending a text message through Amazon Cognito or Amazon SNS for the first time, Amazon SNS places you in a sandbox environment. In the sandbox environment, you can test your applications for SMS text messages. In the sandbox, messages can be sent only to verified phone numbers. +Amazon Cognito uses Amazon Simple Notification Service (Amazon SNS) for delivery of SMS text messages. Amazon SNS in turn hands off SMS messages to AWS End User Messaging SMS. If you are sending a text message through Amazon Cognito for the first time, AWS End User Messaging SMS places you in a [sandbox environment](https://docs.aws.amazon.com/sms-voice/latest/userguide/sandbox.html). In the sandbox environment, you can test your applications for SMS text messages. In the sandbox, you can only simulate the sending of messages. @@ -13 +13,5 @@ Amazon Cognito uses Amazon Simple Notification Service (Amazon SNS) for delivery -Amazon SNS charges for SMS text messages. For more information, see [Amazon SNS pricing](https://aws.amazon.com/sns/sms-pricing/). +###### Note + +In November 2024, AWS replaced Amazon SNS SMS messaging with AWS End User Messaging SMS. Currently, The Amazon Cognito console refers to Amazon SNS resources. User pools initiate SMS messages with the Amazon SNS [Publish](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) operation, which is a pass-through to AWS End User Messaging SMS. Accordingly, you must still configure permissions for `sns:Publish`, not `sms-voice:SendTextMessage`. + +AWS End User Messaging SMS charges for SMS text messages. For more information, see [AWS End User Messaging SMS pricing](https://aws.amazon.com/end-user-messaging/pricing/). @@ -19 +23 @@ Amazon Cognito sends SMS messages to your users with a code that they can enter. -Activity | API operation | Delivery options | Format options | Customizable | Message template +Activity | API operation | Delivery options | Format options | Customizable | [Message template](./cognito-user-pool-settings-message-customizations.html) @@ -21 +25 @@ Activity | API operation | Delivery options | Format options | Customizable | Me -Forgot password | [ForgotPassword](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ForgotPassword.html), [AdminResetUserPassword](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminResetUserPassword.html) | Email, SMS | code | No | N/A +Forgot password | [ForgotPassword](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ForgotPassword.html), [AdminResetUserPassword](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminResetUserPassword.html) | Email, SMS | code | Yes | **Verification message** @@ -25 +29,6 @@ Email address or phone number verification | [UpdateUserAttributes](https://docs -Multi-factor authentication (MFA) | [AdminInitiateAuth](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminInitiateAuth.html), [InitiateAuth](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html) | SMS, authenticator app | code | Yes¹ | **MFA message** +Multi-factor authentication (MFA) | [AdminInitiateAuth](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminInitiateAuth.html), [InitiateAuth](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html) | Email¹, SMS, authenticator app | code | Yes² | **MFA message** +One-time password authentication (OTP) | [AdminInitiateAuth](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminInitiateAuth.html), [InitiateAuth](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html) | Email¹, SMS | code | Yes | **MFA message** ³ + +¹ Requires Essentials [feature plan](./cognito-sign-in-feature-plans.html) or higher and [Amazon SES email configuration](./user-pool-email.html#user-pool-email-developer). + +² For SMS and email messages. @@ -27 +36 @@ Multi-factor authentication (MFA) | [AdminInitiateAuth](https://docs.aws.amazon. -¹ For SMS messages. +³ You can only customize the MFA message template when MFA is required or optional in your user pool. When MFA is inactive, Amazon Cognito sends one-time passwords with the default template. @@ -29 +38 @@ Multi-factor authentication (MFA) | [AdminInitiateAuth](https://docs.aws.amazon. -Amazon SNS charges for SMS messages. For more information, see [Amazon SNS pricing](https://aws.amazon.com/sns/pricing/). +AWS End User Messaging SMS charges for SMS messages. For more information, see [AWS End User Messaging SMS pricing](https://aws.amazon.com/end-user-messaging/pricing/). @@ -37 +46 @@ Amazon Cognito might prevent delivery of additional email or SMS messages to a s -Because of the volume of unsolicited SMS traffic worldwide, some governments impose barriers between the senders and recipients of SMS messages. When you use SMS messages for MFA and user updates, you must take additional steps to ensure that your messages are delivered. You must also monitor SMS-message-related regulations in countries where your users might live and keep your SMS message configuration current. For more information, see [Mobile text messaging (SMS)](https://docs.aws.amazon.com/sns/latest/dg/sns-mobile-phone-number-as-subscriber.html) in the Amazon Simple Notification Service Developer Guide. +Because of the volume of unsolicited SMS traffic worldwide, some governments impose barriers between the senders and recipients of SMS messages. When you use SMS messages for MFA and user updates, you must take additional steps to ensure that your messages are delivered. You must also monitor SMS-message-related regulations in countries where your users might live and keep your SMS message configuration current. For more information, see [SMS and MMS country capabilities and limitations](https://docs.aws.amazon.com/sms-voice/latest/userguide/phone-numbers-sms-support-by-country.html) in the _AWS End User Messaging SMS User Guide_. @@ -52 +61 @@ Review the following links for information about securing your SMS message deliv -Amazon Cognito uses Amazon SNS to send SMS messages to your user pools. You can also use a [Custom SMS sender Lambda trigger](./user-pool-lambda-custom-sms-sender.html) to use your own resources to send SMS messages. The first time that you set up Amazon SNS to send SMS text messages in a particular AWS Region, Amazon SNS places your AWS account in the SMS sandbox for that Region.Amazon SNS uses the sandbox to prevent fraud and abuse and to meet compliance requirements. When your AWS account is in the sandbox, Amazon SNS imposes some [restrictions](https://docs.aws.amazon.com/sns/latest/dg/sns-sms-sandbox.html). For example, you can send text messages to a maximum of 10 phone numbers that you have verified with Amazon SNS. While your AWS account remains in the sandbox, do not use your Amazon SNS configuration for applications that are in production. When you're in the sandbox, Amazon Cognito can't send messages to your users' phone numbers. +Amazon Cognito uses Amazon SNS, and indirectly AWS End User Messaging SMS, to send SMS messages from your user pools. You can also use a [Custom SMS sender Lambda trigger](./user-pool-lambda-custom-sms-sender.html) to use your own resources to send SMS messages. The first time that you set up SMS text messages in a particular AWS Region, AWS End User Messaging SMS places your AWS account in the SMS sandbox for that Region. AWS End User Messaging SMS uses the sandbox to prevent fraud and abuse and to meet compliance requirements. When your AWS account is in the sandbox, AWS End User Messaging SMS imposes some [restrictions](https://docs.aws.amazon.com/sms-voice/latest/userguide/sandbox.html#sandbox-sms). For example, you can send text messages to a maximum of 10 verified destination numbers if you have an origination identity, or you can simulate sending messages without an origination identity. While your AWS account remains in the sandbox, do not send SMS messages in production. When you're in the sandbox, Amazon Cognito can't send messages to your users' phone numbers. @@ -54 +63 @@ Amazon Cognito uses Amazon SNS to send SMS messages to your user pools. You can -###### To send SMS text messages to user pool users +###### Topics @@ -56 +65 @@ Amazon Cognito uses Amazon SNS to send SMS messages to your user pools. You can - 1. Prepare an IAM role that Amazon Cognito can use to send SMS messages with Amazon SNS + * Prepare an IAM role that Amazon Cognito can use to send SMS messages with AWS End User Messaging SMS @@ -58 +67 @@ Amazon Cognito uses Amazon SNS to send SMS messages to your user pools. You can - 2. Choose the AWS Region for Amazon SNS SMS messages + * Choose the AWS Region for SMS messages @@ -60 +69 @@ Amazon Cognito uses Amazon SNS to send SMS messages to your user pools. You can - 3. Obtain an origination identity to send SMS messages to US phone numbers + * Obtain an origination identity to send SMS messages to US phone numbers @@ -62 +71 @@ Amazon Cognito uses Amazon SNS to send SMS messages to your user pools. You can - 4. Confirm that you are in the SMS sandbox + * Confirm that you are in the SMS sandbox @@ -64 +73 @@ Amazon Cognito uses Amazon SNS to send SMS messages to your user pools. You can - 5. Move your account out of Amazon SNS sandbox + * Move your account out of the sandbox @@ -66 +75 @@ Amazon Cognito uses Amazon SNS to send SMS messages to your user pools. You can - 6. Verify phone numbers for Amazon Cognito in Amazon SNS + * Use simulator numbers or verified phone numbers with AWS End User Messaging SMS @@ -68 +77 @@ Amazon Cognito uses Amazon SNS to send SMS messages to your user pools. You can - 7. Complete user pool setup in Amazon Cognito + * Complete user pool setup in Amazon Cognito @@ -73 +82 @@ Amazon Cognito uses Amazon SNS to send SMS messages to your user pools. You can -### Prepare an IAM role that Amazon Cognito can use to send SMS messages with Amazon SNS +### Prepare an IAM role that Amazon Cognito can use to send SMS messages with AWS End User Messaging SMS @@ -87,0 +97,6 @@ The following example IAM role trust policy grants Amazon Cognito user pools a l +JSON + + +**** + + @@ -120 +136 @@ For more information about IAM roles and trust policies, see [Roles terms and co -### Choose the AWS Region for Amazon SNS SMS messages +### Choose the AWS Region for SMS messages @@ -124,4 +139,0 @@ In some AWS Regions, you can choose the Region that contains the Amazon SNS reso -###### Note - -In the AWS Management Console, you can only change the Region for SMS resources after you have switched to the new Amazon Cognito console experience. - @@ -134 +146 @@ Amazon Cognito user pools in the Asia Pacific (Seoul) AWS Region must use your A -Amazon SNS sets the spending quota for all new accounts at $1.00 (USD) per month. You might have increased your spend limit in an AWS Region that you use with Amazon Cognito. Before you change the AWS Region for Amazon SNS SMS messages, open a quota increase case in the AWS Support Center to increase your limit in the new Region. For more information, see [Requesting increases to your monthly SMS spending quota for Amazon SNS](https://docs.aws.amazon.com/sns/latest/dg/channels-sms-awssupport-spend-threshold.html) in the _Amazon Simple Notification Service Developer Guide_. +Amazon SNS (via AWS End User Messaging SMS) sets the spending quota for all new accounts at $1.00 (USD) per month. You might have increased your spend limit in an AWS Region that you use with Amazon Cognito. Before you change the AWS Region for Amazon SNS SMS messages, open a quota increase case in the AWS Support Center to increase your limit in the new Region. For more information, see [Moving from the AWS End User Messaging SMS MMS and Voice sandbox to production](https://docs.aws.amazon.com/sms-voice/latest/userguide/sandbox.html#sandbox-sms-move-to-production) in the _AWS End User Messaging SMS User Guide_. @@ -175,11 +187 @@ If you plan to send SMS text messages to US phone numbers, you must obtain an or -Starting June 1, 2021, US carriers require an origination identity to send messages to US phone numbers. If you don't already have an origination identity, you must get one. To learn how to obtain an origination identity, see [ Requesting a number](https://docs.aws.amazon.com/pinpoint/latest/userguide/settings-request-number.html) in the _Amazon Pinpoint User Guide_. - -If you operate in the following AWS Regions, you must open an Support ticket to obtain an origination identity. For instructions, see [Requesting support for SMS messaging](https://docs.aws.amazon.com/sns/latest/dg/channels-sms-awssupport.html) in the _Amazon Simple Notification Service Developer Guide_. - - * US East (Ohio) - - * Europe (Stockholm) - - * Europe (Paris) - - * Europe (Milan) +US carriers require an origination identity to send messages to US phone numbers. If you don't already have an origination identity, you must get one. To learn how to obtain an origination identity, see [Request a phone number](https://docs.aws.amazon.com/sms-voice/latest/userguide/phone-numbers-request.html) in the _AWS End User Messaging SMS User Guide_. @@ -187,10 +189 @@ If you operate in the following AWS Regions, you must open an Support ticket to - * Middle East (Bahrain) - - * South America (São Paulo) - - * US West (N. California) - - - - -When you have more than one origination identity in the same AWS Region, Amazon SNS chooses an origination identity type in the following order of priority: short code, 10DLC, toll-free number. You can't change this priority. For more information, see [Amazon SNS FAQs](https://aws.amazon.com/sns/faqs/). +When you have more than one origination identity in the same AWS Region, AWS End User Messaging SMS chooses an origination identity type in the following order of priority: short code, 10DLC, toll-free number. You can't change this priority. For more information, see [AWS End User Messaging SMS FAQs](https://aws.amazon.com/end-user-messaging/faqs/). @@ -214 +207 @@ Use the following procedure to confirm that you are in the SMS sandbox. Repeat f -`You are currently in the SMS Sandbox and cannot send SMS messages to unverified numbers.` +**Configure AWS service dependencies to complete your SMS message setup** @@ -218 +211 @@ If you don’t see this message, then someone has set up SMS messages in your ac - 6. Choose the [Amazon SNS](https://console.aws.amazon.com/sns/home) link in the message. This opens the Amazon SNS console in a new tab. + 6. Choose the [Amazon SNS](https://console.aws.amazon.com/sns/home) link under **Move to Amazon SNS production environment**. This opens the Amazon SNS console in a new tab. @@ -227,3 +220 @@ If you don’t see this message, then someone has set up SMS messages in your ac -### Move your account out of Amazon SNS sandbox - -If you are testing your app and you only need to send SMS messages to phone numbers that your administrators can verify, skip this step. +### Move your account out of the sandbox @@ -231 +222 @@ If you are testing your app and you only need to send SMS messages to phone numb -To use your app in production, move your account out of the SMS sandbox and into production. After you have configured an origination identity in the AWS Region that contains the Amazon SNS resources that you want Amazon Cognito to use, you can verify US phone numbers while your AWS account remains in the SMS sandbox. When your Amazon SNS environment is in production, you don't have to verify user phone numbers in Amazon SNS to send SMS messages to your users. +To use your app in production, move your account out of the SMS sandbox and into production. After you have configured an origination identity in the AWS Region that contains the AWS End User Messaging SMS resources that you want Amazon Cognito to use, you can verify US phone numbers while your AWS account remains in the SMS sandbox. When your environment is in production, you don't have to verify user phone numbers before you send SMS messages to them. @@ -233 +224 @@ To use your app in production, move your account out of the SMS sandbox and into -For detailed instructions, see [Moving Out of the SMS Sandbox](https://docs.aws.amazon.com/sns/latest/dg/sns-sms-sandbox-moving-to-production.html) in the _Amazon Simple Notification Service Developer Guide_. +You can create a request to exit the sandbox from either the AWS End User Messaging SMS console or the Amazon SNS console. For detailed instructions, see [Moving from the SMS Sandbox](https://docs.aws.amazon.com/sms-voice/latest/userguide/sandbox.html#sandbox-sms-move-to-production) in the _AWS End User Messaging SMS User Guide_. @@ -235 +226 @@ For detailed instructions, see [Moving Out of the SMS Sandbox](https://docs.aws. -### Verify phone numbers for Amazon Cognito in Amazon SNS +### Use simulator numbers or verified phone numbers with AWS End User Messaging SMS @@ -239,16 +230 @@ If you have moved your account out of the SMS sandbox, skip this step. -When you are in the SMS sandbox, you can send messages to any phone number that you have verified with Amazon SNS. - -To verify a phone number, do the following: - - 1. Add a **Sandbox destination phone number** in the **Text messaging (SMS)** section of the Amazon SNS console. - - 2. Receive an SMS message with a code at the phone number that you provided. - - 3. Enter the **Verification code** from the SMS message in the Amazon SNS console. - - - - -For detailed instructions, see [Adding and verifying phone numbers in the SMS sandbox](https://docs.aws.amazon.com/sns/latest/dg/sns-sms-sandbox-verifying-phone-numbers.html) in the _Amazon Simple Notification Service Developer Guide_. - -###### Note +If you're in the sandbox but you have set up an origination number, you can send messages to verified destination numbers. To set up verified destinations, see [Add a verified destination phone number](https://docs.aws.amazon.com/sms-voice/latest/userguide/verify-destination-phone-number.html) in the _AWS End User Messaging SMS User Guide_. @@ -256 +232 @@ For detailed instructions, see [Adding and verifying phone numbers in the SMS sa -Amazon SNS limits the number of destination phone numbers that you can verify while you are in the SMS sandbox. See [SMS sandbox](https://docs.aws.amazon.com/sns/latest/dg/sns-sms-sandbox.html) in the _Amazon Simple Notification Service Developer Guide_. +You can also send messages with simulated senders and destinations. Simulator messages produce logs but don't get sent out over the carrier network. From the [Shortcuts menu](https://console.aws.amazon.com/sms-voice/home?#/shortcuts), select **Test SMS sending with SMS simulator**. For more information, see [Simulator phone numbers](https://docs.aws.amazon.com/sms-voice/latest/userguide/test-phone-numbers.html) in the _AWS End User Messaging SMS User Guide_.