AWS cognito: Cognito user pools: authentication and threat protection docs
Summary
Restructures the Cognito user pools guide: retitles the page, updates the introduction, removes several TOC links, renames the Security section to Threat protection, condenses MFA/adaptive authentication/AWS WAF and logging guidance, and updates related links.
Security assessment
The changed line documents security features and best practices for protecting user pools, including MFA, adaptive authentication, and AWS WAF. It does not reference a specific vulnerability, CVE, or incident, so it is security documentation rather than a security fix.
Evidence
+Protect your users against password guessing, account takeover, and malicious traffic with multi-factor authentication (MFA), adaptive authentication, and AWS WAF web ACLs. These protections are covered in [Protecting user pools with threat protection](./managing-security.html).
Diff
diff --git a/cognito/latest/developerguide/cognito-user-pools.md b/cognito/latest/developerguide/cognito-user-pools.md index a2eabe6..ff31c1c 100644 --- a//cognito/latest/developerguide/cognito-user-pools.md +++ b//cognito/latest/developerguide/cognito-user-pools.md @@ -9 +9 @@ Features -# Amazon Cognito user pools +# Authenticating users with Amazon Cognito user pools @@ -13 +13 @@ An Amazon Cognito user pool is a user directory for web and mobile app authentic -You can, for example, verify that your users’ sessions are from trusted sources. You can combine the Amazon Cognito directory with an external identity provider. With your preferred AWS SDK, you can choose the API authorization model that works best for your app. And you can add AWS Lambda functions that modify or overhaul the default behavior of Amazon Cognito. +This chapter covers how your users authenticate: signing up, signing in, and the authentication flows a user pool supports, including sign-in through external identity providers. Related tasks are covered in their own chapters—managing the users in your directory, customizing behavior with AWS Lambda triggers, and protecting the pool with threat protection. @@ -25,8 +24,0 @@ You can, for example, verify that your users’ sessions are from trusted source - * [User pool managed login](./cognito-user-pools-managed-login.html) - - * [Customizing user pool workflows with Lambda triggers](./cognito-user-pools-working-with-lambda-triggers.html) - - * [Managing users in your user pool](./managing-users.html) - - * [Understanding user pool JSON web tokens (JWTs)](./amazon-cognito-user-pools-using-tokens-with-identity-providers.html) - @@ -35,10 +26,0 @@ You can, for example, verify that your users’ sessions are from trusted source - * [Messaging and analytics](./user-pools-configure-features.html) - - * [Using Amazon Cognito user pools security features](./managing-security.html) - - * [Multi-Region replication for user pools](./user-pool-multi-region.html) - - * [Updating user pool and app client configuration](./cognito-user-pool-updating.html) - - * [User pool endpoints and managed login reference](./cognito-userpools-server-contract-reference.html) - @@ -60 +42 @@ If you activate user sign-up in your user pool, anyone on the internet can sign -For information about security features that you can set up in your user pools, see [Using Amazon Cognito user pools security features](./managing-security.html). +For information about security features that you can set up in your user pools, see [Protecting user pools with threat protection](./managing-security.html). @@ -66 +48,7 @@ For information about security features that you can set up in your user pools, - 3. You can skip public or federated sign-up, and create users based on your own data source and schema. Add users directly in the Amazon Cognito console or API. Import users from a CSV file. Run a just-in-time AWS Lambda function that looks up your new user in an existing directory, and populates their user profile from existing data. + 3. You can skip public or federated sign-up and create users yourself, based on your own data source and schema, in any of these ways: + + * Add users directly in the Amazon Cognito console or with the API. + + * Import users in bulk from a CSV file. + + * Run a just-in-time AWS Lambda function that looks up each new user in an existing directory and populates their profile from that data. @@ -140 +128 @@ To set up managed login, complete these prerequisites in order: - 1. Create a user pool. See [Getting started with user pools](./getting-started-user-pools.html). + 1. Create a user pool. See [Create a new application in the Amazon Cognito console](./getting-started-user-pools-application.html). @@ -158,17 +146 @@ To set up managed login, complete these prerequisites in order: -### Security - -Your local users can provide an additional authentication factor with a code from an SMS or email message, or an app that generates multi-factor authentication (MFA) codes. You can build mechanisms to set up and process MFA in your application, or you can let managed login manage it. Amazon Cognito user pools can bypass MFA when your users sign in from trusted devices. - -If you don’t want to initially require MFA from your users, you can require it conditionally. With adaptive authentication, Amazon Cognito can detect potential malicious activity and require your user to set up MFA, or block sign-in. - -If network traffic to your user pool might be malicious, you can monitor it and take action with AWS WAF web ACLs. - -###### Related topics - - * [Adding MFA to a user pool](./user-pool-settings-mfa.html) - - * [Advanced security with threat protection](./cognito-user-pool-settings-threat-protection.html) - - * [Associate an AWS WAF web ACL with a user pool](./user-pool-waf.html) - - +### Threat protection @@ -175,0 +148 @@ If network traffic to your user pool might be malicious, you can monitor it and +Protect your users against password guessing, account takeover, and malicious traffic with multi-factor authentication (MFA), adaptive authentication, and AWS WAF web ACLs. These protections are covered in [Protecting user pools with threat protection](./managing-security.html). @@ -179,14 +152 @@ If network traffic to your user pool might be malicious, you can monitor it and -At most stages of a user’s sign-up, sign-in, or profile update, you can customize how Amazon Cognito handles the request. With Lambda triggers, you can modify an ID token or reject a sign-up request based on custom conditions. You can create your own custom authentication flow. - -You can upload custom CSS and logos to give managed login a familiar look and feel to your users. - -###### Related topics - - * [Customizing user pool workflows with Lambda triggers](./cognito-user-pools-working-with-lambda-triggers.html) - - * [Custom authentication challenge Lambda triggers](./user-pool-lambda-challenge.html) - - * [Apply branding to managed login pages](./managed-login-branding.html) - - - +At most stages of sign-up, sign-in, or profile update, you can customize how Amazon Cognito handles the request with Lambda triggers and custom authentication flows, and give managed login a familiar look and feel. See [Customizing user pool workflows with Lambda triggers](./cognito-user-pools-working-with-lambda-triggers.html). @@ -196,18 +156 @@ You can upload custom CSS and logos to give managed login a familiar look and fe -Amazon Cognito user pools log API requests, including requests to managed login, to AWS CloudTrail. You can review performance metrics in Amazon CloudWatch Logs, push custom logs to CloudWatch with Lambda triggers, monitor email and SMS message delivery, and monitor API request volume in the Service Quotas console. - -With the Plus [feature plan](./cognito-sign-in-feature-plans.html), you can monitor user authentication attempts for indicators of compromise with automated-learning technology and immediately remediate risks. These advanced security features also log user activity to your user pool and optionally, to Amazon S3, CloudWatch Logs, or Amazon Data Firehose. - -You can also log device and session data from your API requests to an Amazon Pinpoint campaign. With Amazon Pinpoint, you can send push notifications from your app based on your analysis of user activity. - -###### Related topics - - * [Amazon Cognito logging in AWS CloudTrail](./logging-using-cloudtrail.html) - - * [Tracking quotas and usage in CloudWatch and Service Quotas](./tracking-quotas-and-usage-in-cloud-watch-and-service-quotas.html) - - * [Exporting logs from Amazon Cognito user pools](./exporting-quotas-and-usage.html) - - * [Using Amazon Pinpoint for user pool analytics](./cognito-user-pools-pinpoint-integration.html) - - - +Amazon Cognito user pools log API requests to AWS CloudTrail, publish performance metrics to Amazon CloudWatch Logs, and monitor message delivery and request volume. See [Amazon Cognito logging in AWS CloudTrail](./logging-using-cloudtrail.html). @@ -234 +177 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Common Amazon Cognito scenarios +Migrate to managed login