Kinesis Stream 认证

Question

I have a mobile app with custom authentication that issues a JWT token which does not utilize Cognito at this point. I would like to stream location data from the app after the user authenticates to a Kinesis data stream.

How do I protect the Kinesis data stream to only allow data sent from my authenticated users? I've read that I can create a Cognito Identity Pool with unauthenticated users, but that would allow anyone to obtain a token from Cognito I'm assuming? How do only allow authenticated users of my app to send data to the Kinesis stream?

Answer 1

We can create a REST Api with AWS API Gateway which proxies requests to Kinesis directly. Here is a tutorial

Cognito can serve as authentication server and give you token with necessary permissions to write to Kinesis. But if your mobile application is already secured by custom authentication server and receiving a JWT, I think it's better to use Custom Authorizer, which validates your JWT against your auth server, to secure Api Gateway instead of Cognito.

Tutorial on custom Authorizer lambda function