A web application needs user sign-up, sign-in, and password management.
Avoid building an authentication server and provide standard tokens to the application.
Which service is most appropriate?
Use an Amazon Cognito User Pool for application users and keep it separate from IAM administration of AWS resources.
Detailed explanation
Browser code would expose the secret and create an unsafe design.
Browser code would expose the secret and create an unsafe design.
DNS does not store or manage end-user authentication credentials.
DNS does not store or manage end-user authentication credentials.
IAM is intended for AWS resource access and is not a suitable end-user directory.
IAM is intended for AWS resource access and is not a suitable end-user directory.
A User Pool provides a user directory, sign-in features, and tokens for an application.
A User Pool provides a user directory, sign-in features, and tokens for an application.
Check official documentation
Compare the following points with the official documentation.
Amazon Cognito user poolsの公式説明を確認する。
What to confirm
アプリ利用者認証とAWS API認可のサービスを区別できる。
Key points
- Cognito User Pool
- User directory
- Token
Notes
- Environment: AWS公式Cognitoドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Identity boundary
End-user identity management can be separated from AWS administrator identities.
Credential exposure
Secrets must never be embedded in browser-delivered application code.