This document discusses using Amazon Cognito and API Gateway to securely authenticate and authorize users for APIs. It describes how Cognito Identity Pools can federate with Google for authentication, issue temporary security credentials, and use IAM roles and policies to authorize access to API Gateway resources and backend services like DynamoDB. The document advocates using this approach to add authentication and authorization to APIs in a scalable way.

1. Fortify your API
PRAVEEN BHAT, AWS SOLUTIONS ARCHITECT
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

2. Introduction
• Identity is mission critical for your applications
• Different clients with different levels of confidentiality
Amazon CognitoAmazon API Gateway

3. Amazon Cognito
User Pools
You can easily and securely add sign-up
and sign-in functionality to your mobile
and web apps with a fully-managed
service that scales to support 100s of
millions of users.
Identity Pools
Your users can sign in with third-party
identity providers, such as Facebook
and SAML providers, or Cognito and
you can control access to AWS
resources from your app.

4. Use Case
Demo World
/google
Cognito
(Identity Pool)

5. Cognito Identity Pools (Federation with Google)
Demo World

6. Cognito Identity Pools (Federation with Google)
Demo World
1. Authenticate

7. Cognito Identity Pools (Federation with Google)
Demo World
1. Authenticate
2. Custom token(s)
sent to app

8. Cognito Identity Pools (Federation with Google)
Demo World
Cognito
(Identity Pool)
1. Authenticate
2. Custom token(s)
sent to app
3. Token(s) forwarded to the
associated identity pool

9. Cognito Identity Pools (Federation with Google)
Demo World
Cognito
(Identity Pool)
1. Authenticate
3. Token(s) forwarded to the
associated identity pool
4. Validate token
with IdP
2. Custom token(s)
sent to app

10. Cognito Identity Pools (Federation with Google)
Demo World
Cognito
(Identity Pool)
1. Authenticate
4. Validate token
with IdP
IAM
5. Request AWS creds
3. Token(s) forwarded to the
associated identity pool
2. Custom token(s)
sent to app

11. Cognito Identity Pools (Federation with Google)
Demo World
Cognito
(Identity Pool)
1. Authenticate
4. Validate token
with IdP
6. Send temporary creds
3. Token(s) forwarded to the
associated identity pool
2. Custom token(s)
sent to app
IAM
5. Request AWS creds

12. Cognito Identity Pools (Federation with Google)
API
Gateway
Demo World
Cognito
(Identity Pool)
1. Authenticate
4. Validate token
with IdP
7. Call API GW resource
6. Send temporary creds
IAM
5. Request AWS creds
3. Token(s) forwarded to the
associated identity pool
2. Custom token(s)
sent to app

13. Cognito Identity Pools (Federation with Google)
API
Gateway
Demo World
Cognito
(Identity Pool)
IAM
1. Authenticate
4. Validate token
with IdP
7. Call API GW resource
8. Check IAM Policy
6. Send temporary creds
IAM
5. Request AWS creds
3. Token(s) forwarded to the
associated identity pool
2. Custom token(s)
sent to app

14. Cognito Identity Pools (Federation with Google)
API
Gateway
Demo World
Cognito
(Identity Pool)
/google
/cup
/cip
IAM
1. Authenticate
4. Validate token
with IdP
7. Call API GW resource
8. Check IAM Policy
6. Send temporary creds
5. Request AWS creds
3. Token(s) forwarded to the
associated identity pool
2. Custom token(s)
sent to app

15. Cognito Identity Pools (Federation with Google)
API
Gateway
Demo World
Cognito
(Identity Pool)
/google
/cup
/cip
Lambda DynamoDB
IAM
1. Authenticate
2. Custom token(s)
sent to app
3. Token(s) forwarded to the
associated identity pool
4. Validate token
with IdP
7. Call API GW resource
8. Check IAM Policy
6. Send temporary creds
5. Request AWS creds

16. Summary
• Federate with Google to authenticate using Cognito Identity Pool
• Leverage AWS IAM Roles & Policy to authorize your APIs

17. Call for action

18. Scan QR Code for More Information

19. Thank You