如何仅授予其Cognito子用户和具有完整AWS特权的安全服务器来认证Cognito用户（安全的后端服务器到服务器身份验证）

Question

TL;DR : I want to make an cognito-authenticated request to my own backend API from another server.

I have a node.js backend API (configured by claudia-js and deployed as AWS lambda, interfaced by AWS API gateway and secured with Cognito)

My React frontend can make requests to my backend no problem; I just use react Amplify to log the user in in the usual flow, get a token, then make HTTPS requests to API gateway.

I have another server (AWS elasticbeanstalk, basic username-password auth) which hosts a microservice, connected to a scheduling system (agenda-js) that users can access via the backend API. The problem: We need to be able to communicate the other way.

Jobs are saved to db with the userID (we just use the cognito sub as our userID, it makes things consistent). One job requires contacting the backend API on behalf of our user, on a schedule (once a month, lets say). This requires authenticating as the cognito user, given only the cognito userID, get the token and programatically make the REST/HTTP request to the backend API.

Done:

• Added the job processor server as an app client to my cognito user pool

• Written the job processor that can authenticate against the cognito user pool using my own creds (hardcoded username/pwd)

• Written the secure http request to the backend api using the token from the above step

Job processor code:

// auth and cognito params  
const params = {
    AuthFlow: 'ADMIN_NO_SRP_AUTH',
    ClientId: 'xxxxxxxxxxxxxxxxxxxxxxx',
    UserPoolId: 'XX-XXXX-X_XXXXXXXXX',
    AuthParameters: {
      USERNAME: 'my-username',
      PASSWORD: 'my-pwd',
    },
  };

  cognitoidentityserviceprovider.adminInitiateAuth(params, (err, data) => {
    if (err) console.log(err);
    const token = data.AuthenticationResult.IdToken;

    // HTTP opts to call my backend api
    const options = {
      method: 'GET',
      url: 'https://my.api.url/tasks/action',
      headers: {
        Authorization: `Bearer ${token}`,
      },
      json: true,
    };

    // Call my backend api
    rp(options, (error, response, body) => {
      if (error) throw new Error(error);

      console.log(body);
    });
  });

The above code works perfectly, I am able to call my own API as user (myself, in this case), but I would like to be able to call the API with this script as any user, by providing the cognito auth API with the cognito userID, and an AWS secret key, IAM role or whatever is needed in a .env var or whatever. I just don't know how to achieve this! TIA

Answer 1

For anyone reading: I gave up on this approach and instead authorised the client server using IAM auth and the api gateway sdk client. The user information (non sensitive) is sent in the http body