cognito_skill

Overview

This skill provides hands-on automation and guidance for AWS Cognito user authentication and authorization. It helps create and manage user pools, identity pools, OAuth clients, token flows, and integrations with social or enterprise identity providers. Use it to implement secure sign-up, sign-in, token handling, and temporary AWS credentials for applications.

How this skill works

The skill uses Cognito CLI and boto3 Python examples to create and configure user pools and app clients, handle user sign-up/confirmation, initiate authentication flows, refresh tokens, and exchange tokens for AWS credentials via identity pools. It also includes JWT validation, troubleshooting tips, and recommended security settings like MFA and short token lifetimes. Code snippets show secret-hash generation, SRP and admin auth examples, and CLI commands for pool and user management.

When to use it

• Setting up a new user directory with sign-up and sign-in flows
• Configuring OAuth/OpenID Connect clients and hosted UI callbacks
• Exchanging user tokens for temporary AWS credentials via identity pools
• Implementing MFA, password policies, and adaptive security
• Integrating social (Google/Facebook/Apple) or SAML/OIDC enterprise providers

Best practices

• Enable MFA and strong password policies for all production users
• Keep token lifetimes short for sensitive applications and use refresh tokens securely
• Never expose client secrets in frontend code; perform sensitive flows server-side
• Verify email/phone before granting full access and enable adaptive auth when available
• Use identity pools only for providing temporary AWS credentials and scope them narrowly

Example use cases

• Create a user pool with custom password policy and email verification for a web app
• Register an app client with OAuth code flow and hosted UI for social sign-in
• Implement server-side sign-up and confirmation using secret-hash and boto3
• Use an identity pool to exchange an ID token for temporary S3 access credentials
• Validate incoming JWTs in your API Gateway or backend using Cognito JWKS