AWS res high security documentation change

Service: res · 2026-06-22 · Security-related high

File: res/archive/release-minus-4/ug/setting-up-cognito-users.md

Summary

Added documentation for setting up administrator group for Cognito users, updated table of contents, and made minor text/caption improvements

Security assessment

The change explicitly documents how to configure administrator privileges through Cognito groups. Granting admin privileges is a critical security control that could lead to privilege escalation if misconfigured. The addition shows how to properly restrict admin access by creating a dedicated 'admins' group.

Diff

diff --git a/res/archive/release-minus-4/ug/setting-up-cognito-users.md b/res/archive/release-minus-4/ug/setting-up-cognito-users.md
index 935e1434f..6ab3241d4 100644
--- a//res/archive/release-minus-4/ug/setting-up-cognito-users.md
+++ b//res/archive/release-minus-4/ug/setting-up-cognito-users.md
@@ -7 +7 @@
-Administrative setupUser sign up/sign in flowSign up flowLogin page OptionsConstraintsSynchronizationSecurity considerations for Cognito
+Administrative setupUser sign up/sign in flowSign up flowLogin page OptionsConstraintsAdministrator group for Amazon Cognito usersSynchronizationSecurity considerations for Cognito
@@ -11 +11 @@ Administrative setupUser sign up/sign in flowSign up flowLogin page OptionsConst
-Research and Engineering Studio (RES) allows you to set up Amazon Cognito as a native user directory. This allows users to log in to the web portal and Linux-based VDIs with Amazon Cognito user identities. Administrators can import multiple users into the user pool using a csv file from AWS Console. For more details on bulk user import, see [Importing users into user pools from a CSV file](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool.html) in the _Amazon Cognito Developer Guide_. RES supports using a Amazon Cognito-based native user directory and SSO together. 
+Research and Engineering Studio (RES) allows you to set up Amazon Cognito as a native user directory. This allows users to log in to the web portal and Linux-based VDIs with Amazon Cognito user identities. Administrators can import multiple users into the user pool using a csv file from the AWS Console. For more details on bulk user import, see [Importing users into user pools from a CSV file](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-using-import-tool.html) in the _Amazon Cognito Developer Guide_. RES supports using a Amazon Cognito-based native user directory and SSO together. 
@@ -17 +17 @@ As a RES Administrator, to configure the RES environment to use Amazon Cognito a
-![AWS Cognito Directory section showing provider details, user pool ID, domain URL, and enabled toggles.](/images/res/archive/release-minus-4/ug/images/id-management-cognito-directory.png)
+![Identities management page showing cognito directory settings](/images/res/archive/release-minus-4/ug/images/id-management-cognito-directory.png)
@@ -23 +23 @@ If **User self registration** is enabled, you can give your users the URL of you
-![Sign-in page with username and password fields, Sign In button, and Sign up here link.](/images/res/archive/release-minus-4/ug/images/user-sign-up.png)
+![User sign-in page with option to self-register](/images/res/archive/release-minus-4/ug/images/user-sign-up.png)
@@ -29 +29 @@ Users that choose **Not a user yet? Sign up here** will be asked to enter their
-![Create account form with email, password, and re-enter password fields, plus submit button.](/images/res/archive/release-minus-4/ug/images/create-account.png)
+![Create account page for user self-registration](/images/res/archive/release-minus-4/ug/images/create-account.png)
@@ -33 +33 @@ As part of the sign up flow, users will be asked to enter the verification code
-![Email verification form with fields for email address and verification code, plus Verify button.](/images/res/archive/release-minus-4/ug/images/verify-email.png)
+![Verification code entry page](/images/res/archive/release-minus-4/ug/images/verify-email.png)
@@ -37 +37 @@ If self-sign up is disabled, users will not see the sign up link. Administrators
-![Sign in page for Research and Engineering Studio with username and password fields.](/images/res/archive/release-minus-4/ug/images/user-sign-in.png)
+![Verification code entry page](/images/res/archive/release-minus-4/ug/images/user-sign-in.png)
@@ -43 +43 @@ If both SSO and Amazon Cognito are enabled, an option to **Sign in with organiza
-![Sign in page with username and password fields, Sign In button, and SSO option link.](/images/res/archive/release-minus-4/ug/images/org-sso-sign-in.png)
+![User sign-in page with options to sign up, verify account, or sign-in with organization SSO](/images/res/archive/release-minus-4/ug/images/org-sso-sign-in.png)
@@ -57,0 +58,19 @@ If both SSO and Amazon Cognito are enabled, an option to **Sign in with organiza
+## Administrator group for Amazon Cognito users
+
+By default, RES grants Cognito users within the `admins` group administrator privilege. To add users to the Cognito `admins` group:
+
+  1. Navigate to the [Amazon Cognito console](https://console.aws.amazon.com/cognito/home), and choose the existing user pool used for RES.
+
+  2. Navigate to **Groups** under **User Management** , and then choose **Create a group.**
+
+  3. On the **Create a group** page, in **Group name,** enter `admins`.
+
+  4. Select the `admins` group you created, and choose **Add user to group** to add Cognito users.
+
+  5. Initiate Cognito synchronization manually by following Synchronization. 
+
+
+
+
+After a successful Amazon Cognito synchronization, users added to the `admins` group will receive administrator privileges.
+