Amazon Cognito

1import {
2  CognitoIdentityProviderClient,
3  InitiateAuthCommand,
4  SignUpCommand,
5  ConfirmSignUpCommand,
6  ForgotPasswordCommand,
7  ConfirmForgotPasswordCommand,
8} from '@aws-sdk/client-cognito-identity-provider';
9
10const cognito = new CognitoIdentityProviderClient({ region: 'us-east-1' });
11
12const CLIENT_ID = process.env.COGNITO_CLIENT_ID;
13
14// 1. Register a new user
15await cognito.send(new SignUpCommand({
16  ClientId: CLIENT_ID,
17  Username: 'alice@example.com',
18  Password: 'SecurePass123!',
19  UserAttributes: [
20    { Name: 'email', Value: 'alice@example.com' },
21    { Name: 'name',  Value: 'Alice Johnson' },
22    { Name: 'custom:tier', Value: 'premium' },
23  ],
24}));
25
26// 2. Confirm registration (code sent to email)
27await cognito.send(new ConfirmSignUpCommand({
28  ClientId: CLIENT_ID,
29  Username: 'alice@example.com',
30  ConfirmationCode: '123456',
31}));
32
33// 3. Sign in — USER_PASSWORD_AUTH flow
34const { AuthenticationResult } = await cognito.send(new InitiateAuthCommand({
35  ClientId: CLIENT_ID,
36  AuthFlow: 'USER_PASSWORD_AUTH',
37  AuthParameters: {
38    USERNAME: 'alice@example.com',
39    PASSWORD: 'SecurePass123!',
40  },
41}));
42
43const { IdToken, AccessToken, RefreshToken } = AuthenticationResult;
44
45// 4. Refresh tokens
46const refreshed = await cognito.send(new InitiateAuthCommand({
47  ClientId: CLIENT_ID,
48  AuthFlow: 'REFRESH_TOKEN_AUTH',
49  AuthParameters: { REFRESH_TOKEN: RefreshToken },
50}));

1import { CognitoJwtVerifier } from 'aws-jwt-verify';
2
3const verifier = CognitoJwtVerifier.create({
4  userPoolId: 'us-east-1_AbCdEfGhI',
5  tokenUse: 'access',           // 'id' or 'access'
6  clientId: process.env.COGNITO_CLIENT_ID,
7});
8
9// Express middleware
10async function requireAuth(req, res, next) {
11  try {
12    const token = req.headers.authorization?.replace('Bearer ', '');
13    const payload = await verifier.verify(token);
14
15    req.user = {
16      sub:   payload.sub,          // unique user ID — use as your userId
17      email: payload.email,
18      tier:  payload['custom:tier'],
19      groups: payload['cognito:groups'] ?? [],
20    };
21
22    next();
23  } catch {
24    res.status(401).json({ error: 'Unauthorized' });
25  }
26}

1# Authorization endpoint — redirect user here to sign in
2GET https://<domain>.auth.us-east-1.amazoncognito.com/oauth2/authorize
3  ?response_type=code
4  &client_id=<CLIENT_ID>
5  &redirect_uri=https://app.example.com/callback
6  &scope=openid+email+profile
7  &state=random-csrf-token
8
9# Token endpoint — exchange authorization code for tokens
10POST https://<domain>.auth.us-east-1.amazoncognito.com/oauth2/token
11  grant_type=authorization_code
12  &code=<AUTH_CODE>
13  &redirect_uri=https://app.example.com/callback
14  &client_id=<CLIENT_ID>
15
16# Logout endpoint
17GET https://<domain>.auth.us-east-1.amazoncognito.com/logout
18  ?client_id=<CLIENT_ID>
19  &logout_uri=https://app.example.com

1// Pre Token Generation trigger — add custom claims to the JWT
2exports.handler = async (event) => {
3  // Fetch additional user data from DynamoDB
4  const userTier = await getUserTierFromDB(event.userName);
5
6  event.response = {
7    claimsOverrideDetails: {
8      claimsToAddOrOverride: {
9        'custom:tier':        userTier,
10        'custom:featureFlags': 'dark-mode,beta-dashboard',
11      },
12      claimsToSuppress: ['address'], // remove sensitive claims
13    },
14  };
15
16  return event;
17};

1// Custom auth flow — passwordless OTP via email
2// 1. Define Auth Challenge
3exports.defineAuthChallenge = async (event) => {
4  event.response.challengeName = 'CUSTOM_CHALLENGE';
5  event.response.issueTokens = false;
6  event.response.failAuthentication = false;
7  return event;
8};
9
10// 2. Create Auth Challenge — send OTP
11exports.createAuthChallenge = async (event) => {
12  const otp = Math.floor(100000 + Math.random() * 900000).toString();
13  await sendOtpEmail(event.request.userAttributes.email, otp);
14
15  event.response.publicChallengeParameters = { destination: event.request.userAttributes.email };
16  event.response.privateChallengeParameters = { answer: otp };
17  return event;
18};
19
20// 3. Verify Auth Challenge — check OTP
21exports.verifyAuthChallenge = async (event) => {
22  event.response.answerCorrect =
23    event.request.challengeAnswer === event.request.privateChallengeParameters.answer;
24  return event;
25};

1// Client sends JWT in Authorization header
2const response = await fetch('https://api.example.com/orders', {
3  headers: {
4    Authorization: idToken,   // ID Token for API Gateway Cognito Authorizer
5    // OR
6    Authorization: `Bearer ${accessToken}`, // Access Token for ALB or Lambda authorizer
7  },
8});

1// Authenticated IAM role policy — user can only access their own S3 prefix
2{
3  "Effect": "Allow",
4  "Action": ["s3:GetObject", "s3:PutObject"],
5  "Resource": "arn:aws:s3:::user-uploads/${cognito-identity.amazonaws.com:sub}/*"
6}

1import { CognitoIdentityClient, GetIdCommand, GetCredentialsForIdentityCommand } from '@aws-sdk/client-cognito-identity';
2import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
3
4const identityClient = new CognitoIdentityClient({ region: 'us-east-1' });
5
6// 1. Get Identity ID (maps the user to a Cognito Identity)
7const { IdentityId } = await identityClient.send(new GetIdCommand({
8  AccountId: '123456789012',
9  IdentityPoolId: 'us-east-1:abc-123-def',
10  Logins: {
11    'cognito-idp.us-east-1.amazonaws.com/us-east-1_XYZ': idToken, // from User Pool
12  },
13}));
14
15// 2. Exchange for AWS credentials
16const { Credentials } = await identityClient.send(new GetCredentialsForIdentityCommand({
17  IdentityId,
18  Logins: {
19    'cognito-idp.us-east-1.amazonaws.com/us-east-1_XYZ': idToken,
20  },
21}));
22
23// 3. Use temporary credentials directly
24const s3 = new S3Client({
25  region: 'us-east-1',
26  credentials: {
27    accessKeyId:     Credentials.AccessKeyId,
28    secretAccessKey: Credentials.SecretAccessKey,
29    sessionToken:    Credentials.SessionToken,
30  },
31});
32
33await s3.send(new PutObjectCommand({
34  Bucket: 'user-uploads',
35  Key: `${IdentityId}/profile.jpg`,
36  Body: imageBuffer,
37}));