AWS res documentation change
Summary
Added new section 'Administrator group for Amazon Cognito users' explaining how to create an 'admins' group and assign users for administrator privileges. Updated image captions and minor text edits.
Security assessment
The change documents role-based access control (RBAC) by describing how to assign admin privileges through Cognito groups. This improves security posture by enabling least privilege principles, but doesn't address a specific vulnerability. No evidence of patching a security incident exists in the diff.
Diff
diff --git a/res/archive/release-minus-2/ug/setting-up-cognito-users.md b/res/archive/release-minus-2/ug/setting-up-cognito-users.md index e87850c79..5513466b5 100644 --- a//res/archive/release-minus-2/ug/setting-up-cognito-users.md +++ b//res/archive/release-minus-2/ug/setting-up-cognito-users.md @@ -5 +5 @@ -Administrative setupUser sign up/sign in flowSign up flowLogin page OptionsConstraintsSynchronizationSecurity considerations for Cognito +Administrative setupUser sign up/sign in flowSign up flowLogin page OptionsConstraintsAdministrator group for Amazon Cognito usersSynchronizationSecurity considerations for Cognito @@ -9 +9 @@ Administrative setupUser sign up/sign in flowSign up flowLogin page OptionsConst -Research and Engineering Studio (RES) allows you to set up Amazon Cognito as a native user directory. This allows users to log in to the web portal and Linux-based VDIs with Amazon Cognito user identities. Administrators can import multiple users into the user pool using a csv file from AWS Console. For more details on bulk user import, see [Importing users into user pools from a CSV file](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool.html) in the _Amazon Cognito Developer Guide_. RES supports using a Amazon Cognito-based native user directory and SSO together. +Research and Engineering Studio (RES) allows you to set up Amazon Cognito as a native user directory. This allows users to log in to the web portal and Linux-based VDIs with Amazon Cognito user identities. Administrators can import multiple users into the user pool using a csv file from the AWS Console. For more details on bulk user import, see [Importing users into user pools from a CSV file](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool.html) in the _Amazon Cognito Developer Guide_. RES supports using a Amazon Cognito-based native user directory and SSO together. @@ -15 +15 @@ As a RES Administrator, to configure the RES environment to use Amazon Cognito a - + @@ -21 +21 @@ If **User self registration** is enabled, you can give your users the URL of you - + @@ -27 +27 @@ Users that choose **Not a user yet? Sign up here** will be asked to enter their - + @@ -31 +31 @@ As part of the sign up flow, users will be asked to enter the verification code - + @@ -35 +35 @@ If self-sign up is disabled, users will not see the sign up link. Administrators - + @@ -41 +41 @@ If both SSO and Amazon Cognito are enabled, an option to **Sign in with organiza - + @@ -55,0 +56,19 @@ If both SSO and Amazon Cognito are enabled, an option to **Sign in with organiza +## Administrator group for Amazon Cognito users + +By default, RES grants Cognito users within the `admins` group administrator privilege. To add users to the Cognito `admins` group: + + 1. Navigate to the [Amazon Cognito console](https://console.aws.amazon.com/cognito/home), and choose the existing user pool used for RES. + + 2. Navigate to **Groups** under **User Management** , and then choose **Create a group.** + + 3. On the **Create a group** page, in **Group name,** enter `admins`. + + 4. Select the `admins` group you created, and choose **Add user to group** to add Cognito users. + + 5. Initiate Cognito synchronization manually by following Synchronization. + + + + +After a successful Amazon Cognito synchronization, users added to the `admins` group will receive administrator privileges. +