Amazon Web Services Cognito

Amazon Cognito lets you add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily. Amazon Cognito scales to millions of users and supports sign-in with social identity providers, such as Apple, Facebook, Google, and Amazon, and enterprise identity providers via SAML 2.0 and OpenID Connect.

In Cognito, we can create multiple userpools and each userpool can hold users, groups and manage different sign-ins. An integration with AWS Cognito is directly with a single userpool. Customer can have multiple userpools under a single Cognito account.

To create an AWS account, you need:

• A paid Oracle Cloud Infrastructure (OCI) account, or an OCI trial account. See Oracle Cloud Infrastructure Free Tier.

• OCI administrator sign-in credentials

• AWS IAM administrator sign-in credentials

• AWS Cognito UserPool Access

To create an application in OCI identity, you need:

• Identity domain administrator or security administrator role for the OCI IAM identity domain. See Understanding Administrator Roles.

• The following AWS cognito configuration information:

  • AccessKeyId

  • SecretAccessKey

  • External ID

  • Role ARN

  • Account Region

  • Cognito User Pool Id

  • (Optional) List of Group Names from which one wants to synchronize users

1. Click Roles and then Create role.

2. In Select trusted entity:

   1. Click AWS account.

   2. In options, select the externalID checkbox.

   3. Provide the externalID value. This value can be any entry which can be unique for your reference only. For example, "cognito-integration".

   4. Click Next.

3. Add Permissions.

   1. Select the previously created policy cognitoAPIAccessPolicy.

   2. Click Next.

4. On the Details tab:

   1. Provide the role name, for example, "cognitoApiAccessRole".

   2. Click Save.

Result: The role is created.

Note:- Please have the ARN value of the role created in previous step

1. Click Policies and then Create policy.

2. Provide the following values:

   1. Service: STS

   2. Actions: AssumeRole

   3. Resources: Add role ARN.

      1. Click the ARN link.

      2. Click list ARNs manually.

      3. Provide the role ARN value created in previous step and click Add.

      4. Click Next.

3. Provide tags, if required.

4. Provide a policy name, for example, "assumeRolePolicy".

5. Click Create policy.

1. Click Users and then Create user.

2. Enter a username, for example, "serviceAccountUser".

   1. Select the Access key - Programmatic access checkbox.

   2. Click Next.

3. Set the permissions:

   1. Select attach existing policy.

   2. Select the assume role policy created earlier. say assumeRolePolicy

   3. Click Next and then review.

   4. Click Create user. Result: The user is created.

4. Copy the values for accessKeyId and secretAccessKey for the user. These values would be used for configuring the cognito application in OCI identity domain.

1. Access the OCI Console with your identity domain administrator credentials.

2. Open the navigation menu and click Identity & Security. Under Identity, click Domains. Select the identity domain you want to work in and click Applications.

3. Click Add application.

4. In the Add application window, click Application Catalog, and then Launch app catalog.

5. Locate and select AWS Cognito.

6. Provide the application name and click Next.

7. Click Enable Provisioning and confirm.

8. Provide all the following configuration details: Note:- Sample values provided for reference only.

   Configuration	Description	Sample Value
   AWS Cognito Region	Provide the AWS Cognito region value	us-east-1
   Cognito User Pool Id	Provide the AWS Cognito User Pool id value	us-east-1_9876543210
   List of Groups	Provide the list of groups for syncing users belonging to those groups. If no groups are provided, Application would brings all groups, users and user-group memberships. Note:- Please provide every group name in a new line	idp-adminidp-support
   Access Key ID	Access key id value of the service user	None
   Secret Access Key	Secret Access Key of the service user	None
   External ID	External Id value provided as part of the role creation	cognito-integration
   Role ARN	Role ARN value	arn:aws:iam::1234567890:role/cognitoApiAccessRole

9. Select the Authoritative sync checkbox.

10. Turn on Enable synchronization.

11. Click Finish and then Save.

12. Click Test Connectivity to test the connection.

13. Click Activate to activate the application.

If the test connection passed and the application is activated, then import all users, groups, and user-group memberships from AWS Cognito to OCI Identity.

1. Click Import under Resources.

2. Click Import to start the job.

Result: All synchronized users display in the Console.

There are no known issues topics at this time.

For other issues, open a support ticket. See Open a Support Ticket.