amr在aws cognito中是什么意思

Question

https://mobile.awsblog.com/post/Tx1OSMBRHZVM9V0/Understanding-Amazon-Cognito-Authentication-Part-3-Roles-and-Policies

I'm pretty new to AWS. This blog series about AWS Cognito keep mentioning about amr like examples below

"ForAnyValue:StringLike": {
    "cognito-identity.amazonaws.com:amr": "login.myprovider.myapp"
}

Finally, we specify that the amr of the token contains the value unauthenticated.

I couldn't find and figure out what it means.

Answer 1

amr stands for 'Authentication Methods References'. That comes from the OpenID Connect specification. http://openid.net/specs/openid-connect-core-1_0.html

In the context of Cognito, this represents how the user was authenticated. For example if the user was authenticated using any of the supported providers (facebook, google, amazon), the amr will contain 'authenticated' and also the name for the provider eg 'graph.facebook.com' if user was authenticated using facebook. If the user was authenticated using google, it will be 'accounts.google.com'. If the user was authenticated without using any supported providers (Unauthenticated Identity), it will be 'unauthenticated'.

This is useful when you use Cognito Credenitials to access your AWS services and want to implement fine grained access control

Answer 2

This is a really old question but I think it's worth mentioning that [AMR is an array[(https://self-issued.info/docs/draft-ietf-oauth-amr-values-01.html#rfc.section.2) in case anybody (like me) didn't notice. That's the reason why in your condition clause you need to use ForAnyValue:StringLike not just StringLike. Example:

"Condition": {
    "StringEquals": {
        "cognito-identity.amazonaws.com:aud": "us-east-1:<your-id-pool-id>"
     },
     "ForAnyValue:StringLike": {
         "cognito-identity.amazonaws.com:amr": "authenticated"
     }
}