AWS re:Post을(를) 사용하면 다음에 동의하게 됩니다. AWS re:Post 이용 약관
AWS re:Postre:Post

How to limit the number of signups in Cognito(prevent fake signup)

0

How to prevent fake user signups with Cognito? If some malicious actor sends fake user singup requests to the UserPool endpoint, the free tier of Cognito will be soon exhaust. If they continue to create fake account our organization will be billed a lot of money.

How to the limit number of daily signups? Or not count signups as MAUs?

주제
서버리스컴퓨팅프론트엔드 웹 및 모바일보안, 신원 및 규정 준수클라우드 재무 관리
태그
AWS LambdaAWS Amplify아마존 CognitoAWS 청구DDOS 방어
언어
English
jjshen
질문됨 한 달 전217회 조회
2개 답변
1

Hello jjshen,

  1. Implement Pre-Signup Lambda Triggers for additional validation, like CAPTCHA, to deter bots.
  2. Enable Multi-Factor Authentication (MFA) to complicate automated signups.
  3. Use API Gateway rate limiting to control the rate of signup requests.

I'm here to help.

profile picture
Vitor Castellani
답변함 한 달 전
  • jjshen
    한 달 전

    Hello Vitor, Thank you very much for your reply. I've been working on implementing the first piece of advice you shared, which involves integrating Pre-Signup Lambda Triggers into my Cognito user pool. The logic implemented by lambda is: if the number of users in the userpool exceeds 3, an exception will be thrown and signup will stop. Given that my user pool already contains three users, I proceeded to attempt the addition of a new user through my Vue application. I think the Pre-Signup Lambda Triggers did work, because I truly received an exception in my browser. But the new user are still added in to my userpool with their confirmation status marked as "confirmed". Could you give me some information about what‘s wrong with my code? ========Lambda Code============= import json import boto3 def lambda_handler(event, context): # TODO implement cognito_client = boto3.client('cognito-idp') user_pool_id = 'ap-northeast-1_******' response = cognito_client.list_users( UserPoolId=user_pool_id, AttributesToGet=[], Limit=0 ) user_count = len(response['Users'])

    if user_count >= 3:
    raise Exception("Stop signup: the number of accounts is over 3")
else:
    return event
0

Here are some approaches you can consider:

Enable CAPTCHA Verification https://docs.aws.amazon.com/waf/latest/developerguide/waf-captcha-and-challenge.html :- Enabling CAPTCHA verification for the signup form in your application helps to differentiate between human users and automated bots by requiring users to complete a challenge, such as selecting specific images or entering text from a distorted image.

Implement Email or SMS Verification https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-email-phone-verification.html :-This adds an extra layer of authentication and helps to ensure that only legitimate users can complete the signup process.

Implement Fraud Detection https://aws.amazon.com/it/blogs/machine-learning/prevent-fake-account-sign-ups-in-real-time-with-ai-using-amazon-fraud-detector/ : Integrate with fraud detection services or use machine learning models to detect and block suspicious signup attempts in real-time. You can use AWS services like Amazon Fraud Detector to build custom fraud detection rules and models tailored to your specific use case.

Monitor Usage and Set Budget Alerts https://docs.aws.amazon.com/cognito/latest/developerguide/create-a-cloud-watch-alarm.html : Regularly monitor your AWS usage and set up billing alerts to notify you if your Cognito costs exceed a certain threshold. This can help you proactively manage and control your expenses related to Cognito usage.

Additionally, staying vigilant and continuously monitoring your Cognito environment will help you detect and respond to any suspicious activity in a timely manner.

profile picture
전문가
Adeleke Adebowale J
답변함 한 달 전
profile picture
전문가
Mina Gobrial - OptimeCloud
검토됨 한 달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠