amazon-web-servicesamazon-cognitoaws-userpools

cross account usage of AWS cognito user pool for signin


I have two AWS accounts, let's say 'master' and 'regional'. My 'master' account has used AWS Cognito and so it has created user-pool named as 'master-user-pool'. i.e. 'master-user-pool' belongs to 'master' AWS account.

Now, I want all users of 'master-user-pool' to be available on 'regional' AWS account's Cognito, so that 'regional' account can issue token (cognito's) to users who were in 'master' account. Any ways?

To clarify, I'm not referring API Gateway's cross account cognito authoriser since it is for APIs.

My case is different as mentioned above.


Solution

  • Amazon Cognito does not directly support cross-account JWT Token generation.

    However, you implement a lateral way to achieve this use-case. You could use Cognito Identity Pool on the "Master" to generate temporary AWS Credentials, which can be used by the "Regional" account to make Cognito User Pool API calls. It is not advisable to implement such a lateral system for a production application, as it has its own share of pitfalls. Amazon Cognito does not offer any API or feature to back-up a User Pool either.

    If you do decide to implement the recursive approach, I would recommend starting out by thoroughly understanding the difference between User Pools and Identity Pools. I had written an article for the same which elucidates upon the difference. You can then use your Identity Pool and RBAC to indirectly utilize another User Pool.

    Another lateral way I can think of is via AWS Lambda, and securely loading credentials for the "master" account while using a managed AWS security service like AWS Secrets Manager or SSM Parameter Store.

    Either way, to conclude, there is no straight-forward way to get this use-case working, and a lateral work-around/hack is the only way to go about it.