AWS Mobile Services: Amazon Cognito - Identity Broker and Synchronization Service - Jinesh Varia

AWS Mobile Services : Deep Dive on
Amazon Cognito
Stefano Buliani (@sapessi)
Jinesh Varia (@jinman)
© 2011 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified or distributed in whole or in part without the express consent of Amazon.com, Inc.

How to build a mobile app today?

Authenticate users
Manage users and
identity providers
Authorize access
Securely access
cloud resources
Synchronize data
Sync user prefs
across devices
Analyze User Behavior
Store and share media
Store user-generated photos
Media and share them
Deliver media
Automatically detect mobile devices
Deliver content quickly globally
Send push notifications
Bring users back to your app by sending
messages reliably
Store shared data
Track active users,
engagement
Store and query fast NoSQL data
across users and devices
Your
Mobile
App
Track Retention Stream real-time data
Manage funnels,
Campaign performances
Collect real-time clickstream logs
and take actions quickly

Introducing AWS Mobile Services
Your Mobile App, Game or Device App
AWS Mobile SDK, API Endpoints, Management Console
Amazon Cognito Amazon Mobile Analytics Amazon SNS Mobile Push
Kinesis Connector DynamoDB Connector S3 Connector SQS ConnectorSES Connector
Compute Storage Networking Analytics Databases
AWS Global Infrastructure (10 Regions, Availability Zones, 51 Edge Locations)
Integrated SDK
Mobile Optimized
Services
Mobile Optimized
Connectors
Core Building Block
Services

Cross-platform, Optimized for Mobile
User identity &
data synchronization
service
Fast cross-platform
Analytics & reporting
Service
Powerful Cross-platform
Push notification service
Store any NoSQL
data and also map
mobile OS specific
objects to
DynamoDB tables
Recorder that can
handle intermittent
network connection
Easily upload,
download to S3 and
also pause,
resume, and cancel
these operations
Send email
reliably from
device
Access
distributed
buffering and
queuing service

Fully Integrated AWS Mobile SDK
• Common authentication mechanism across
all services
• Automatically handle intermittent network
connections
• Cross-platform Support: Android, iOS, Fire
OS
• Native SDKs optimized for Mobile OS, for
example, uses the local offline caching
architecture
• Reduced memory footprint; Pick and choose
the service jars you need

Authenticate users
Amazon Cognito
(Identity Broker)
Authorize access
AWS Identity and
Access Management
Synchronize data
Amazon Cognito
(Sync)
Analyze User Behavior
Store and share media
Your
Mobile
App
AWS Mobile SDK
Amazon Mobile
Analytics
Amazon S3
Transfer Manager
Deliver media
Amazon CloudFront
(Device Detection)
Send push notifications
Amazon SNS
Mobile Push
Store shared data
Amazon DynamoDB
(Object Mapper)
Stream real-time data
Amazon Kinesis
(Recorder)
Track Retention
Amazon Mobile
Analytics

Amazon Cognito

Amazon Cognito
“Your App data is secure, available offline, and kept in sync between devices”
Simplifies Identity and
Access Management
Implement security best
practices
Securely access all
AWS services from
Mobile device
Cross-device and
Cross-platform Sync
Synchronize user’s data
across devices and
platforms
Guest Your own
Auth
Manage users as
unique identities across
identity providers

Unique
Joe Anna Bob Identities
Identity
Providers
Any Device
Any Platform
Any AWS
Service
Amazon Cognito Identity
Support Multiple Login Providers
Easily integrate with major login providers for
authentication.
Unique Users vs. Devices
Manage unique identities. Automatically
recognize unique user across devices and
platforms.
Helps implement security best
practices
Securely access any AWS Service from mobile
device. It simplifies the interaction with AWS
Identity and Access Management
Mobile
Analytics
S3 DynamoDB Kinesis

Amazon Cognito for Unauthenticated Identities
Guest User Access
Securely access AWS resources and leverage
app features without the need to create an
account or logging in
Save Data to the Cloud
Save app and device data to the cloud and
merge them after login
Unique Identifier for Your “Things”
“Headless” connected devices can also
securely access cloud services.
Visitor
Preferences
Guest
Cognito
Store
EC2 S3 DynamoDB Kinesis

Use Case: Unique Identity across the web and mobile

Use case: State transition
Users begin their life as guests

Later on they register an account
• The transition should be
seamless

Multiple accounts can be linked
• You should have a consistent
identifier

Use case: Game State

Getting Started with Cognito in 3 steps
Sign up for AWS Account and login to AWS Management Console
Create identitypool for authenticated and
unauthenticated users in the AWS Console
Download and integrate the Mobile SDK and store and
sync user data in a dataset

Demo: Amazon Cognito Console

Amazon Cognito Security
Safeguard AWS Credentials
No need to embed credentials in the app
anymore. Get least-privileged temporary
credentials.
Helps implement security best practices
Securely access any AWS Service. It simplifies
the interaction with Security Token Service and
removes the need of Token Vending Machine
Set granular access permissions on AWS
resources
Get fine-grained access control to cloud
resources.
EC2 S3 DynamoDB Kinesis

Amazon Cognito Security Architecture
Login OAUTH/OpenID
Access Token
End Users
App with
AWS Mobile
SDK
Access
Token
Pool ID
Role ARNs
Cognito ID,
Temp
Credentials
Access
to AWS
Services
Cognito Identity
Cognito ID
(Temp
Credentials)
S3
Mobile Analytics
DynamoDB
Developer
Broker
Cognito Sync
Store
AWS
Management
Console

Developer-Authenticated Identities
Your own user authentication system
Several apps prefer to have their own username
and password instead of public identity providers
for authentication.
Easily integrate with existing systems
Implement GetOpenIdTokeForDeveloperIdentity()
using our server-side SDKs like Java, Python,
Ruby etc.
Manage mappings easily
Cognito manages the mappings across login
systems (public or private) using a unique Cognito
ID
Username
And Password
Your
User Authentication
System

Developer Authenticated Identities
Cognito Identity
Cognito ID
(Temp
Credentials)
S3
Mobile Analytics
DynamoDB
User Authentication
System
(Running on AWS or not)
Username
password
OIDC Token
End Users
Developer
App with
AWS Mobile
SDK
Get OpenID Token
OIDC Token
OIDC Token
Pool ID
Role ARNs
Cognito ID,
Temp Credentials
Access
to AWS
Services
Broker
Cognito Sync
Store
AWS
Management
Console

Amazon Cognito: Authorize Access using AWS IAM

Amazon Cognito (Identity Broker)
Identitypool
Identity
Providers
identitypool
Pool of identities that
share the same trust policy
Web Identity
Federation
Access
Policy
Access to
AWS
Services
authenticated
identities
Unauthenticated
Identities
AWS IAM Roles
AWS
Account
S3
DynamoDB
Get Delete Put

Access Policy for the IAM Role
{
"Effect":"Allow",
"Action":["s3:*"],
"Resource":"*"
}
{
"Effect": ”Deny",
"Action": ["dynamodb:*"],
"Resource": "*"
}
{
"Effect": "Allow",
"Action": [”cognito-sync:*"],
"Resource": "*"
}
Allow
Actions:
All S3, Sync store
Operations
Resource:
All resources within
these services
Deny
Actions:
All DDB Operations
Resource:
All resources

Access Policy Restriction
{
"Effect":"Allow",
"Action":["s3:PutObject","s3:GetObject","s3:DeleteObject",
"s3:ListMultipartUploadParts","s3:AbortMultipartUpload"],
"Resource":"arn:aws:s3:::BUCKET_NAME/*"
}
{
"Effect":"Allow",
"Action":["s3:ListBucket","s3:ListBucketMultipartUploads"],
"Resource":"arn:aws:s3:::BUCKET_NAME"
}
{
"Effect": "Allow",
"Action": ["dynamodb:GetItem", "dynamodb:Query", "dynamodb:PutItem"],
"Resource" : [ "arn:aws:dynamodb:REGION:123456789:table/TABLE_NAME",
"arn:aws:dynamodb:REGION:123456789:table/TABLE_NAME/
index/INDEX_NAME" ]
}
Allow
Actions:
Certain operations
Resource:
One bucket, table ..

Access Policy Restriction
{
"Effect":"Allow”,
"Action”
["s3:PutObject","s3:GetObject","s3:DeleteObject”,”s3:
ListMultipartUploadParts","s3:AbortMultipartUpload"],
"Resource":"arn:aws:s3:::BUCKET_NAME/Bob/*"
}
{
"Effect":"Allow",
"Action":"s3:ListBucket",
"Resource":"arn:aws:s3:::BUCKET_NAME",
"Condition":{"StringLike":{"s3:prefix":”Bob/"}}
}
{
"Effect":"Allow",
"Action":["s3:ListBucketMultipartUploads"],
"Resource":"arn:aws:s3:::BUCKET_NAME"
}
Allow
Actions:
Certain operations
Resource:
Within a bucket with
specific prefix (user)

Access Policy Restriction (Policy Variables)
Allow
Actions:
All sync operations
Resource:
Only to that identity
{
"Effect":"Allow",
"Action":"cognito-sync:*",
"Resource":["arn:aws:cognito-sync:us-east-1:
123456789012:identitypool/
${cognito-identity.amazonaws.com:aud}/identity/
${cognito-identity.amazonaws.com:sub}/*"]
}
{
"Effect": "Allow”,
"Action": ["s3:GetObject”,"s3:PutObject”],
"Resource": ["arn:aws:s3:::
myBucket/amazon/snakegame/
${cognito-identity.amazonaws.com:sub}"]
}
Allow
Actions:
S3 Get/Put operations
Resource:
Only to a specific part
of bucket to that identity

Synchronize data across devices : Amazon Cognito (Sync)

What have customers told us about “Synchronized
Profile”
People have multiple devices and want to transition between devices.
Implementing a user profile that syncs across devices, OS, apps is hard.
It not only has to work when offline, but easy to integrate with existing apps.

Amazon Cognito Sync
User Data
Storage and
Sync
Any Platform
Identity pool
k/v data
iOS/Android/FireOS
Store App Data, Preferences and State
Save app and device data to the cloud and merge
them after login
Cross-device Cross-OS Sync
Sync user data and preferences across devices
with one line of code
Work Offline
Data always stored in local SQLite DB first.
Works seamlessly when intermittent or no
connectivity

Amazon Cognito Sync
Offline: The client SDK manages a local SQLite data
store to allow the app to work even when connectivity is
not available.
Fast: The methods to read and write data only interact
with the local SQLite database.
Intelligent Sync: The sync method compares the local
version of the data to the cloud sync store, pushes up
deltas and pulls down new changes.
Flexible Conflict resolution: The sync method first
reads the changes then writes its local changes to the
cloud sync store By default Cognito assumes that the
last write wins. Developers can override and
implement their own conflict resolution programmatically
Local SQLite Cache

Sync Data Model
Identity Pool: Pool of app users. Can be
shared across apps.
Identity: An individual user. Consistent
across identity providers. Can be a guest
user.
Dataset: Per user grouping of data. The
most granular level of sync. Up to 1MB.
Record: Key/Value pair user data
AWS
Account
1:60
Identity
Pool
1:n
Identity
Identity
Identity
1:20
Dataset
Dataset
Dataset
1:1024
Dataset
Dataset
Record
You
Your App
Your App Users
User Data
Container
User Data

Sync Data Model - Example
Identitypool1
User
preferences
Developer has two
apps: a game and a
productivity app
Game
state
Productivity
App
Game
App
AWS
Account
1:60
Identity
Pool
1:n
Identity
Identity
Identity
1:20
Dataset
Dataset
Dataset
1:1024
Dataset
Dataset
Record
You
Your App
Your App Users
User Data
Container
User Data

Integrating Cognito Sync functionality is dead simple
Initialize the CredentialsProvider and CognitoClient
provider = new CognitoCachingCredentialsProvider (context, AWS_ACCOUNT_ID,
COGNITO_POOL_ID, COGNTIO_ROLE_UNAUTH, COGNITO_ROLE_AUTH, Regions.US_EAST_1);
cognito = new CognitoSyncManager (context, COGNITO_POOL_ID, Regions.US_EAST_1, provider);
Create or open Dataset and Add Key Values
cognito.openOrCreateDataset(datasetName);
dataset.put(key, value);
Call synchronize on the dataset
dataset.synchronize(new SyncCallback(){..});

Integrating Cognito Sync functionality is dead simple
Initialize the AWSCognitoSyncClient
AWSCognitoSyncClient *syncClient = [[AWSCognitoSyncClient alloc]
initWithConfiguration: configuration];
Create or open Dataset and Add Key Values
DataSet *dataset = [syncClient openOrCreateDataSet:@"myDataSet"];
NSString *value = [dataset readStringForKey:@"myKey"];
[dataset putString:@"my value" forKey:@"myKey"];
Call synchronize on the dataset
[dataset synchronize];
iOS

Simple and predictable pay as you go pricing
Amazon Cognito
Free Tier (for first 12 months):
1 Million syncs/month + 10GB
of storage for Amazon Cognito
Thereafter:
$0.15 for 10K Syncs
$0.15 per GB for storage
Number of monthly
sync operations
1,000,000
Monthly sync charge (1,000,000 / 10,000) *
$0.15 = $15
Sync store space 4.77GB
Monthly sync store
charge
4.77 * $0.15 = $0.72
Total charge $15.72

Summary

Key Takeaways
AWS Global Infrastructure (10 Regions, Availability Zones, 51 Edge Locations)
Integrated SDK
Mobile Optimized
Services
Mobile Optimized
Connectors
Core Building Block
Services

Key Takeaways: Amazon Cognito
Cross Platform
and Optimized
for Mobile
Flexibility
And Freedom
Fully integrated
and easy to get
started
of Choice
AWS Global Infrastructure (10 Regions, Availability Zones, 51 Edge
Locations)
Integrated SDK
Mobile Optimized
Services
Mobile Optimized
Connectors
Core Building Block
Services

Get Started Today With Cognito for Free!
Amazon Cognito
Free Tier (for first 12
months):
1 Million syncs/month +
10GB of storage
Amazon Cognito: http://aws.amazon.com/cognito/
FAQ: http://aws.amazon.com/cognito/faqs/
AWS Mobile blog: http://mobile.awsblog.com/
AWS Mobile SDK: http://aws.amazon.com/mobile/sdk/
Cognito developer forum:
https://forums.aws.amazon.com/forum.jspa?forumI
D=173
http://aws.amazon.com/mobile

Thank You!
Jinesh Varia, Stefano Buliani
@jinman, @sapessi

AWS Mobile Services: Amazon Cognito - Identity Broker and Synchronization Service - Jinesh Varia

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to AWS Mobile Services: Amazon Cognito - Identity Broker and Synchronization Service - Jinesh Varia

Similar to AWS Mobile Services: Amazon Cognito - Identity Broker and Synchronization Service - Jinesh Varia (20)

More from Amazon Web Services

More from Amazon Web Services (20)

AWS Mobile Services: Amazon Cognito - Identity Broker and Synchronization Service - Jinesh Varia

Editor's Notes