AWS cognito: Cognito overview: new 'What you can build' scenarios section
Summary
Added a new 'What you can build with Amazon Cognito' section describing common application shapes (user pool sign-in with JWTs, protecting back-end APIs, identity pool temporary AWS credentials, social/SAML/OIDC federation, and M2M client_credentials authorization), plus updated internal links to the new getting-started page.
Security assessment
The added content is conceptual overview material that describes authentication/authorization patterns (JWT verification, limited-privilege temporary credentials, M2M client_credentials), which is security-adjacent guidance rather than a fix for a specific vulnerability.
Evidence
+Machine-to-machine (M2M) authorization issues an access token to an app, service, or device that authenticates as itself with the `client_credentials` grant, with no human user in the loop. See [Authorize machine-to-machine (M2M) applications](./cognito-scenarios.html#scenario-machine-to-machine).
Diff
diff --git a/cognito/latest/developerguide/what-is-amazon-cognito.md b/cognito/latest/developerguide/what-is-amazon-cognito.md index 1c49a0b..530652b 100644 --- a//cognito/latest/developerguide/what-is-amazon-cognito.md +++ b//cognito/latest/developerguide/what-is-amazon-cognito.md @@ -7 +7 @@ -Which parts of Amazon Cognito do you need?User poolsIdentity poolsFeatures of Amazon CognitoAmazon Cognito user pools and identity pools comparisonGetting started with Amazon CognitoRegional availabilityPricing for Amazon Cognito +Which parts of Amazon Cognito do you need?What you can build with Amazon CognitoUser poolsIdentity poolsFeatures of Amazon CognitoAmazon Cognito user pools and identity pools comparisonGetting started with Amazon CognitoRegional availabilityPricing for Amazon Cognito @@ -16,0 +17,2 @@ Amazon Cognito is an identity platform for web and mobile apps. It’s a user di + * What you can build with Amazon Cognito + @@ -60,0 +63,31 @@ Neither component requires the other. A user pool can issue tokens to your own b +## What you can build with Amazon Cognito + +Most Amazon Cognito applications fall into a few common shapes. Use this list to find the one closest to what you're building, then follow the link for the full walkthrough. + +Sign users in to your app + + +A user pool authenticates your users and issues JSON web tokens (JWTs) that your app or API verifies. This is the starting point for most apps that need sign-up and sign-in. See [Authenticate with a user pool](./cognito-scenarios.html#scenario-basic-user-pool). + +Protect your own API or back-end resources + + +Use the access token from a user pool to authorize requests to your server-side resources, or let Amazon API Gateway validate the token and gate access to a Lambda function or your own API. See [Access back-end resources with user pool tokens](./cognito-scenarios.html#scenario-backend) and [Access resources with API Gateway and Lambda with a user pool](./cognito-scenarios.html#scenario-api-gateway). + +Give users temporary access to AWS services + + +Exchange a user pool token with an identity pool for temporary, limited-privilege AWS credentials so your app can call services like Amazon S3 and Amazon DynamoDB on the user's behalf. See [Access AWS services with a user pool and an identity pool](./cognito-scenarios.html#scenario-aws-and-user-pool). + +Let users sign in with Google, Apple, or an enterprise directory + + +Federate through a social or SAML/OIDC provider. A user pool brokers the sign-in and issues your app a standard set of tokens, or an identity pool exchanges the external token directly for AWS credentials. See [Authenticate with a third party and access AWS services with an identity pool](./cognito-scenarios.html#scenario-identity-pool). + +Authorize an application or device with no human user + + +Machine-to-machine (M2M) authorization issues an access token to an app, service, or device that authenticates as itself with the `client_credentials` grant, with no human user in the loop. See [Authorize machine-to-machine (M2M) applications](./cognito-scenarios.html#scenario-machine-to-machine). + +For the full set of scenarios with architecture diagrams, see [Common Amazon Cognito scenarios](./cognito-scenarios.html). + @@ -154 +187 @@ Customize user attributes | Assign values to user attributes and add your own cu -For more information about user pools, see [Getting started with user pools](./getting-started-user-pools.html) and the [Amazon Cognito user pools API reference](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/). +For more information about user pools, see [Create a new application in the Amazon Cognito console](./getting-started-user-pools-application.html) and the [Amazon Cognito user pools API reference](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/). @@ -220 +253 @@ Attribute-based access control | Transform user claims into principal tags for y -For example user pool applications, see [Getting started with user pools](./getting-started-user-pools.html). +For example user pool applications, see [Create a new application in the Amazon Cognito console](./getting-started-user-pools-application.html).