Securing Applications with Amazon Cognito

In my AWS Cloud Architecture training, I completed a practical lab on Amazon Cognito — a service that makes it easy to add user authentication and authorization to applications.

In this article, I’ll share the complete step-by-step guide in a simple and beginner-friendly format.

Lab Overview

What We Will Learn:

• Create a Cognito User Pool for authentication
• Connect a web application to the User Pool
• Configure an Identity Pool for temporary AWS credentials
• Test login and access control

Step-by-Step Lab Instructions

Task 1: Prepare the Lab Environment

1. Open AWS Details → Copy Cloud9URL → Open it in a new tab.
2. In the Cloud9 terminal, run:

wget https://aws-tc-largeobjects.s3.us-west-2.amazonaws.com/CUR-TF-200-ACACAD-3-113230/10-lab-mod9-guided-Cognito/code.zip
unzip code.zip
cd resources
. ./setup.sh

3. Note the S3 Bucket Name and CloudFront Domain provided.

4. Edit website/scripts/config.js:

• Replace <cloudfront-domain> with your actual CloudFront domain (add https://).

5. Upload the website to S3:

cd /home/ec2-user/environment
aws s3 cp website s3://YOUR-S3-BUCKET/ --recursive --cache-control "max-age=0"

6. Start the Node server:

cd /home/ec2-user/environment/node_server
npm start

Leave this terminal running.

7. In AWS Console → CloudFront, wait until status becomes Enabled.

Task 2: Test the Website

Open https://YOUR-CLOUDFRONT-DOMAIN in a browser.

You should see:

• Home page and Birds page working
• Sightings page showing Access Denied
• Login page available

Task 3: Create Cognito User Pool

1. Go to Cognito → User Pools → Create User Pool.
2. Configure:

• Application Type: Traditional web application
• Application Name: bird_app_client
• Sign-in Options: Username
• Required Attribute: Email
• Return URL: https://YOUR-CLOUDFRONT-DOMAIN/callback.html

3. Create and rename the pool to bird_app.

4. Copy the User Pool ID.

Get Pawan Singh’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

5. Configure App Client settings (enable Authorization Code Grant + Implicit Grant, keep Email + OpenID).

6. Create two users:

• testuser / Lab-password1$
• admin / Admin123$

7. Create Administrators group and add the admin user to it.

Task 4: Connect Application to User Pool

1. Stop the server (Ctrl + C).
2. Edit website/scripts/config.js and fill in:

• COGNITO_DOMAIN_STR
• COGNITO_USER_POOL_ID_STR
• COGNITO_USER_POOL_CLIENT_ID_STR
• CLOUDFRONT_DISTRO_STR

3. Upload the website again to S3.

4. Replace files in node_server and update package.json with your User Pool ID.

5. Restart the server (npm start).

Task 5: Test User Authentication

• Login as testuser → Sightings page should now work.
• Login as admin → SiteAdmin page should be accessible.

Task 6: Configure Identity Pool

1. Go to Cognito → Identity Pools → Open bird_app_id_pool.
2. Copy Identity Pool ID.
3. Add Cognito User Pool as Identity Provider (use your User Pool and App Client).

Task 7: Connect Identity Pool to Application

1. Stop server.
2. Uncomment and fill COGNITO_IDENTITY_POOL_ID_STR in config.js.
3. Update auth.js with your User Pool ID.
4. Upload website to S3 again.
5. Restart the server.

Task 8: Final Test

1. Open the Birds app.
2. Go to Report → Login as admin.
3. Click Validate My Temporary AWS Credentials.
4. You should see successful connection to DynamoDB.

Final Thoughts

This Cognito lab taught me how to add secure user authentication and temporary AWS credentials to web applications. It’s a very useful skill for building real-world secure apps in AWS.