AWS res medium security documentation change
Summary
Added documentation for configuring administrator group privileges in Cognito and updated image captions/formatting
Security assessment
The addition of the 'Administrator group for Amazon Cognito users' section explicitly documents security controls for granting admin privileges. This addresses access control by specifying how to limit administrative rights through group membership, which directly impacts authorization security. Misconfiguration here could lead to privilege escalation risks.
Diff
diff --git a/res/archive/release-minus-1/ug/setting-up-cognito-users.md b/res/archive/release-minus-1/ug/setting-up-cognito-users.md index 1169bc5ad..afec125bf 100644 --- a//res/archive/release-minus-1/ug/setting-up-cognito-users.md +++ b//res/archive/release-minus-1/ug/setting-up-cognito-users.md @@ -5 +5 @@ -Administrative setupUser sign up/sign in flowSign up flowLogin page OptionsConstraintsSynchronizationSecurity considerations for Cognito +Administrative setupUser sign up/sign in flowSign up flowLogin page OptionsConstraintsAdministrator group for Amazon Cognito usersSynchronizationSecurity considerations for Cognito @@ -9 +9 @@ Administrative setupUser sign up/sign in flowSign up flowLogin page OptionsConst -Research and Engineering Studio (RES) allows you to set up Amazon Cognito as a native user directory. This allows users to log in to the web portal and Linux-based VDIs with Amazon Cognito user identities. Administrators can import multiple users into the user pool using a csv file from AWS Console. For more details on bulk user import, see [Importing users into user pools from a CSV file](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool.html) in the _Amazon Cognito Developer Guide_. RES supports using a Amazon Cognito-based native user directory and SSO together. +Research and Engineering Studio (RES) allows you to set up Amazon Cognito as a native user directory. This allows users to log in to the web portal and Linux-based VDIs with Amazon Cognito user identities. Administrators can import multiple users into the user pool using a csv file from the AWS Console. For more details on bulk user import, see [Importing users into user pools from a CSV file](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool.html) in the _Amazon Cognito Developer Guide_. RES supports using a Amazon Cognito-based native user directory and SSO together. @@ -15 +15 @@ As a RES Administrator, to configure the RES environment to use Amazon Cognito a - + @@ -21 +21 @@ If **User self registration** is enabled, you can give your users the URL of you - + @@ -27 +27 @@ Users that choose **Not a user yet? Sign up here** will be asked to enter their - + @@ -31 +31 @@ As part of the sign up flow, users will be asked to enter the verification code - + @@ -35 +35 @@ If self-sign up is disabled, users will not see the sign up link. Administrators - + @@ -41 +41 @@ If both SSO and Amazon Cognito are enabled, an option to **Sign in with organiza - + @@ -55,0 +56,19 @@ If both SSO and Amazon Cognito are enabled, an option to **Sign in with organiza +## Administrator group for Amazon Cognito users + +By default, RES grants Cognito users within the `admins` group administrator privilege. To add users to the Cognito `admins` group: + + 1. Navigate to the [Amazon Cognito console](https://console.aws.amazon.com/cognito/home), and choose the existing user pool used for RES. + + 2. Navigate to **Groups** under **User Management** , and then choose **Create a group.** + + 3. On the **Create a group** page, in **Group name,** enter `admins`. + + 4. Select the `admins` group you created, and choose **Add user to group** to add Cognito users. + + 5. Initiate Cognito synchronization manually by following Synchronization. + + + + +After a successful Amazon Cognito synchronization, users added to the `admins` group will receive administrator privileges. +