{
  "@context": [
    "https://www.w3.org/ns/credentials/v2"
  ],
  "type": [
    "VerifiableCredential",
    "BlogPostCredential"
  ],
  "id": "urn:uuid:9701e2be-4296-475d-86d1-ceef8fa0dcde",
  "issuer": "did:webvh:QmTVQnV3qGxWzWmnmWJAy1zkYswgbUmE95K5qodmAizVfr:mjendza.net",
  "validFrom": "2026-03-15T13:35:32Z",
  "credentialSubject": {
    "title": "CIAM with AWS Cognito",
    "author": "Mateusz Jendza",
    "body": "![Cognito-LogIn](/images/cognito/factorlabs-login.jpg)\r\n\r\n## TL;DR\r\nYou started your cloud journey with AWS and you need to authenticate your first customers, partners. You don't want to build your own authentication service - you want to use a managed service. AWS Cognito is a great solution for you. It is easy to start with, cheap, and easy to integrate with the frontend and backend. You can start with a sample solution from AWS and workshop.\r\n\r\n## Solution Overview\r\nIt is my first attempt in around three years without AWS Cognito. My last playground, https://github.com/mjendza/aws-sandbox, was connected with Event Driven Design, and in the 'background', I used AWS Cognito.\r\nI wanted to refresh the code and play around with Identity Management. \r\n\r\nBut after a while and a couple of npm packages update, I noticed:\r\n- My old repo based on CDK v1 with is deprecated. \r\n- A lot of logic connected with Event Driven Design - will be not needed with new sandbox.\r\n\r\nI needed to make a decision:\r\n- When I decided to test AWS Cognito one more time - my code-base is too old :(.\r\n- Need to start from scratch, with fresh code base.\r\n\r\n## Code\r\nThere is amazing code sample from AWS: [amazon-cognito-passwordless-auth](https://github.com/aws-samples/amazon-cognito-passwordless-auth) and also [workshop](https://catalog.workshops.aws/cognito-webauthn-passwordless/en-US/100-contributors).\r\n\r\nI work on Windows - and for me the frontend deployment and backend `read configuration from file` doesn't work. Maybe there are issues connected with my Windows workstation, or perhaps I have spent too much time in the last years with C# :).\r\n\r\nBut with the sample solution from aws-samples - with the knowledge how CDK works and how to work with TypeScript is really one day to start.\r\n\r\n## A summary: \r\n- Easy to start with sample and workshop.\r\n- Cheap solution - first 50k users are free. Next 0.0025 per user (Monthly Active User).\r\n- Easy to integrate with the frontend - with the backend - with the other AWS services.\r\n- I started with `local` and password-less solutions.  \r\n- AWS CDK is amazing - you can build your infrastructure as a code, test it, with the same language. I decided to use TypeScript, but can be Java or C#.\r\n- Sample solution shows only log in method - you need to extend the user journals with sign up, account recovery, etc.\r\n- Please remember - with the custom UI you can't use OpenID Connect - check decision tree from AWS: [Decision criteria matrix](https://aws.amazon.com/blogs/security/use-the-hosted-ui-or-create-a-custom-ui-in-amazon-cognito/).\r\n- Also, an excellent video from AWS about identity challenges: [Identity on the Front Line](https://www.youtube.com/watch?v=60Ts61j4cAw)\r\n\r\n## What next?\r\n- I will try to integrate a custom domain to the Custom UI.\r\n- Extend the flow with the sign-up, and then maybe with account recovery.",
    "datePublished": "2024-06-09",
    "url": "/post/ciam-with-cognito",
    "description": "Authenticate your first customers with AWS Cognito",
    "tags": [
      "Authentication",
      "Security",
      "AWS",
      "Cognito",
      "CIAM"
    ]
  },
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-jcs-2022",
    "verificationMethod": "did:key:z6MksoqpqENZmzzA4nhCPkfcbWtRHVegGV38Yqu2arRc5Er2#z6MksoqpqENZmzzA4nhCPkfcbWtRHVegGV38Yqu2arRc5Er2",
    "created": "2026-03-15T13:35:32Z",
    "proofPurpose": "assertionMethod",
    "proofValue": "zwjtiDTE1bGRxD3vLvCSVUJQyHrRinUKZvYeimecGNrRTUovc16BRJHEdStMqwnnkb9JfLEdzv2xTPfTQtUVvL1r"
  }
}