- [Mahmoud] Hi, everyone.
Amazon Cognito User Pools
is a service that AWS customers use
for managing identity of their customers.
It is a fully managed service
for all customer identity and access management use cases.
Today, Amazon Cognito and AWS Web Application Firewall
jointly launched a native integration
that brings significant security benefits
to Amazon Cognito customers.
This allows you to protect identity layer
of your applications which use Amazon Cognito
from common web exploits, DDoS attacks,
unwanted bot traffic,
and any other traffic that can consume extensive resources
and affect availability of your resources and application.
Let's take a look at how this works.
You begin by defining web access control list,
or web ACL in WAF.
This includes one or more security rules
with which you would like to enforce on your tracker.
For example, you can have great limiting rules
to make sure that clients
don't send more than a specific number of requests
within a few minutes.
You can also add deny list or allow list tools.
You can also filter traffic
based on geographic locations or specific patterns,
like a combination of headers, user agents,
and many other possibilities.
You can even write more sophisticated rules
that apply to certain application clients
or specific API calls in Cognito.
This information is available
as headers in the requests,
and you can write rules that target specific flows.
You can also use wide range of managing rules
or rules available in the Marketplace
from AWS Security Partners.
This web ACL is then associated with a Cognito user pool.
When Cognito user pool receives authentication
or user management requests from clients,
which could be OAuth 2 endpoints
and out of the box hosted sign-up and sign-in pages,
or federation flows,
it could also be traffic
coming from web or mobile applications
using the SDK or DirectTrust API calls to Cognito user pool.
It could also be machine authentications
coming from the client credentials flow,
or backend authentications,
like things running in a proxy or backend components.
When Cognito receives this traffic,
it sends sanitized requests to WAF for inspection,
and WAF will run requests
against the web ACL that is associated with the user pool,
and will make a decision.
If the decision is to allow the request,
Cognito moves on with processing the request.
Otherwise, the proper response is return it to the client.
It could be a block, it could be a custom response,
or it could be CAPTCHA,
in cases where Cognito controls the UI
and when it calls to flows
and the hosted sign-in and sign-up pages.
You can enable this feature in two different ways.
You can do this from the Amazon Cognito console
by going to the user pool properties under the user pool,
and activating WAF and selecting a web ACL from there.
You can also do this from the AWS WAF console
by creating a new web ACL,
or editing the associations of an existing web ACL.
And now, you will see that Amazon Cognito user pools
is an available resource,
but you can associate a web ACL too.
Now, let's give it a try, and see how to configure it
and how this works in action.
From Amazon Cognito console,
you can go to user pool properties
under the user pool that you would like to enable WAF on,
and now, you see that there is an AWS WAF card here.
You can edit this card and enable WAF,
and then, choose a web ACL to associate.
You can also click on these links
to take you to the WAF console
so you can create a new web ACL if you would like to.
From the WAF admin console,
you'll begin by creating a web ACL.
Give your web ACL a name,
and from the associated resources here,
add a resource,
and select the Amazon Cognito user pool
that you would like to apply this to.
Then, you start adding security rules to this web ACL.
Just as an example, let's add a rate limiting,
choosing rate-based rule,
and giving a number for the number of the requests
that you would like to allow from a single client
within five minutes.
The lowest number is 100,
and I will continue until I create this web ACL.
Now, all user management action that come to this user pool
will be inspected against this web ACL.
If I try to access the hosted sign-in pages
of this user pool,
and I send more than 100 requests within five minutes,
I will be challenged with a CAPTCHA.
Let's see this in action.
I have already made more than the allowed requests
within five minutes.
So, if I try to refresh this page,
I will be asked to confirm that I am a human,
and this is the CAPTCHA response coming from WAF.
After solving the puzzle, this is going to succeed,
and it will take me back to the hosted UI
with a session that is valid for five minutes.
This is just one scenario,
but you can definitely define the rule
that applies to your security requirements.
And if I try to send API calls to this user pool,
the same rule will be enforced,
and if I exceed the 100 requests within five minutes,
I will receive a forbidden exception
that this request is blocked due to CAPTCHA from WAF.
Because this is an API call
and there is no UI that Cognito controls,
this exception will be relayed to the application,
and it will be up to the application
on how to handle this exception.
You can start using this feature today,
and if you are running workload in production
that uses Amazon Cognito,
it is highly recommended that you enable WAF
to get maximum protection
for your applications and resources.
Thank you.