Which one to use Cognito User Pool or Identity Pool For Social signIn?

Question

We are using ECS for deploying our flask based application and API gateway for allowing the Authenticated users. Only Application hosted on ECS should hit the Database, and no way end-user can hit DB.

My Question is, If the user sign-in from Cognito user pool (either from facebook or google), will he able to surpass the api gateway and reach the ECS and hit DB? or will the user faces Issues regarding the AWS credentials and Permissions by API gateway?

(I am aware that If user sign-in through Identity pool Idp's end-user will be allocated IAM-Permissons and AWS manages it from then)

Thanks

Answer 1

You can use both. However I would recommend using Cognito User Pool and Hosted UIs. Cognito User Pool has the capability of integrating Identity Providers like Facebook and Google for Social Sign In, with the possibility of attributes mapped to Cognito User Pool attributes automatically. You can then configure a Cognito Identity Pool to register users that have signed up/ signed in to Cognito User Pool (through social identity providers or through regular sign in) to obtain temporary AWS credentials.

Sample code:

const AWS = require('aws-sdk');
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
                IdentityPoolId: <identity pool id>,
                Logins: {
                    'cognito-idp.<region>.amazonaws.com/<user pool id>': <user jwt token>
                }
});

Also bear in mind that you have three ways of authorizing access to API Gateway:

1. IAM through Identity Pool (Sign requests with AWS signer)

2. Cognito (by supplying JWT directly through Authorization: 'Bearer <jwt>' headers in your request).

3. Custom Lambda authorizer ( implement custom logic but have to decode JWT yourself using public key available at https://cognito-idp .{region}.amazonaws.com/{userPoolId}/.well-known/jwks.json )

Using both identity and user pool, you can implement fined grained RBAC by choosing either to pass role through token (uses roles granted by group role for example) or through rules you set up based on user attributes from user pool.

More info on that here

Hope I have been of help :)