AWS cognito: Cognito updated issuer: ALB compatibility and OIDC workaround guidance
Summary
Replaced the statement that updated issuers are incompatible with ALB/API Gateway authorizers with guidance that the native authenticate-cognito ALB action is unsupported, recommending the generic authenticate-oidc integration with the user pool's OIDC endpoints instead.
Security assessment
The change documents authentication integration behavior for Cognito updated issuers, including a supported OIDC-based alternative for ALB authentication. It is authentication configuration guidance rather than a fix for a specific vulnerability.
Evidence
+The updated issuer type isn't compatible with the native Amazon Cognito integration for Application Load Balancer authentication (the `authenticate-cognito` action). To use an updated issuer with an Application Load Balancer, configure the generic OIDC integration (the `authenticate-oidc` action) instead, and provide your user pool's OIDC endpoints. For more information, see [Authenticate users using an Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html).
Diff
diff --git a/cognito/latest/developerguide/federation-endpoints.md b/cognito/latest/developerguide/federation-endpoints.md index c12b70e..de5b386 100644 --- a//cognito/latest/developerguide/federation-endpoints.md +++ b//cognito/latest/developerguide/federation-endpoints.md @@ -68 +68 @@ Updated issuers take the format `https://issuer-cognito-idp.`us-east-1`.amazonaw -The updated issuer type is not currently compatible with Application Load Balancer authentication with Amazon Cognito ([Authenticate users using an Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html)) or Amazon API Gateway Amazon Cognito authorizers ([Control access to REST APIs using Amazon Cognito user pools as authorizer](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html)). +The updated issuer type isn't compatible with the native Amazon Cognito integration for Application Load Balancer authentication (the `authenticate-cognito` action). To use an updated issuer with an Application Load Balancer, configure the generic OIDC integration (the `authenticate-oidc` action) instead, and provide your user pool's OIDC endpoints. For more information, see [Authenticate users using an Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html).