AWS cognito: Cognito multi-Region failover guidance for AWS GovCloud (US)
Summary
Adds a note and a new section explaining that Amazon Cognito doesn't support automatic Route 53 health-check failover in AWS GovCloud (US) Regions, and provides manual failover steps: creating a prefix domain with managed login, adding the secondary domain's redirect/ACS URLs to federated IdPs, pointing applications at the active Region's OAuth 2.0 endpoints, and activating the replica pool. Also notes passkey relying-party-ID limitations and manual failback, and rewords the custom-domain DNS sentence.
Security assessment
The change is operational failover documentation, but it carries authentication-relevant guidance: it instructs operators to register the secondary domain's OAuth2/SAML redirect and ACS URLs with federated IdPs, warns that passkeys are bound to a per-domain relying party ID, and requires the replica pool to be set ACTIVE before traffic shifts. Misconfiguring these redirect/ACS URLs or RP IDs affects federated sign-in and authentication continuity, but no specific vulnerability, CVE, or incident is referenced, so it is security-adjacent hardening guidance rather than a fix.
Evidence
+ 2. If your user pool has federated identity providers (IdPs), add the secondary domain's redirect URL to each IdP. For OIDC and social IdPs, add `https://`secondary-domain`/oauth2/idpresponse` as an allowed redirect URI. For SAML IdPs, add `https://`secondary-domain`/saml2/idpresponse` as an assertion consumer service (ACS) URL. If you skip this step, federated sign-in fails after you switch traffic to the secondary domain.
Diff
diff --git a/cognito/latest/developerguide/user-pool-multi-region.md b/cognito/latest/developerguide/user-pool-multi-region.md index c2aeb75..5aafaf0 100644 --- a//cognito/latest/developerguide/user-pool-multi-region.md +++ b//cognito/latest/developerguide/user-pool-multi-region.md @@ -300,0 +301,4 @@ With multi-Region user pools, you can fail over managed login, federated login, +###### Note + +Amazon Cognito doesn't currently support automatic failover with a Route 53 health check in the AWS GovCloud (US) Regions. For information about routing traffic to the secondary Region in AWS GovCloud (US), see Failover in the AWS GovCloud (US) Regions. + @@ -307 +311 @@ To enable failover, set up a [health check](https://docs.aws.amazon.com/Route53/ -The DNS record for your custom domain can use Route 53 or any third-party DNS provider. Ensure you have a valid CNAME record in your DNS provider pointing to your target alias, which is a CloudFront distribution. You can find the alias target on the **Domain** page in the Amazon Cognito console. +For custom domains, the DNS record can use Route 53 or any third-party DNS provider. Ensure you have a valid CNAME record in your DNS provider pointing to your target alias, which is a CloudFront distribution. You can find the alias target on the **Domain** page in the Amazon Cognito console. @@ -337,0 +342,30 @@ If you use both managed login endpoints and APIs, use the same Route 53 health c +### Failover in the AWS GovCloud (US) Regions + +Amazon Cognito doesn't currently support automatic failover with a Route 53 health check in the AWS GovCloud (US) Regions. You can't set the `Routing` field on a user pool domain, and custom domains aren't available. To continue serving managed login, federation, and OAuth 2.0 endpoints from the secondary Region, configure a prefix domain for each replica user pool and route traffic between the domains yourself. + +Complete the following steps before you need to fail over. Before you begin, create a replica user pool in the secondary Region. + +###### To prepare for failover in the AWS GovCloud (US) Regions + + 1. In the secondary Region, create a prefix domain for the replica user pool with managed login. In a `CreateUserPoolDomain` request, set `ManagedLoginVersion` to `2`, or choose **Managed login** on the **Domain** menu in the Amazon Cognito console. Replica user pools don't support domains with the classic hosted UI. Each domain has a Region-specific URL. + + 2. If your user pool has federated identity providers (IdPs), add the secondary domain's redirect URL to each IdP. For OIDC and social IdPs, add `https://`secondary-domain`/oauth2/idpresponse` as an allowed redirect URI. For SAML IdPs, add `https://`secondary-domain`/saml2/idpresponse` as an assertion consumer service (ACS) URL. If you skip this step, federated sign-in fails after you switch traffic to the secondary domain. + + 3. Configure your application to send requests to the authorize, token, logout, and other OAuth 2.0 endpoints on the domain in the Region that's serving traffic. Include machine-to-machine (M2M) clients that request tokens with the client credentials grant. + + 4. Before you send traffic to the secondary Region, change the replica user pool status to `ACTIVE`. + + + + +When you route traffic to the secondary domain, consider the following: + + * **Passkeys** – Passkeys that users registered on the primary domain don't work on the secondary domain, because the relying party ID is different for each domain. To sign in to managed login on the secondary domain, users must use another sign-in method. This doesn't affect applications that use the SDKs and set their own domain as the relying party ID. + + * **Failback** – Amazon Cognito doesn't route traffic back to the primary Region. When the primary Region is available again, update your application to send traffic to the primary domain. + + + + +For information about routing API and SDK traffic, see Failover for Amazon Cognito APIs and SDKs. +