Cognito Configuration and Architectural Question: Using Userpools for Device Authentication

Your situation presents an interesting challenge in managing authentication for both users and devices using Amazon Cognito. Based on your requirements, it's possible to use your existing user pools to handle device authentication without creating a third user pool. Here's an approach you could consider:

1. Use Existing User Pools for Device Authentication: Instead of creating a separate user pool for devices, you can create device "users" within your existing user pools. This approach allows you to maintain your current two-pool structure while accommodating device authentication.

2. Device as a User: Treat each device as a special type of user in your existing user pools. You can create a unique username for each device (e.g., device_id_123) and associate it with device-specific attributes.

3. Custom Attributes: Utilize custom attributes in your user pools to differentiate between human users and devices. For example, you could add a custom attribute like "user_type" with values "human" or "device".

4. Device Credentials: Generate and store unique credentials for each device. These could be username/password combinations or, preferably, use client credentials grant type which is more suitable for machine-to-machine communication.

5. Token Scopes: Use token scopes to control and differentiate the access levels between human users and devices. You can define custom scopes for devices that limit their access to only the necessary resources.

6. Device Remembering: Leverage Amazon Cognito's device remembering feature. This allows you to associate devices with user accounts, which can be useful if you need to track which devices are associated with which users.

7. API Gateway Integration: At the API Gateway level, you can use a single authorizer that validates tokens from both user pools. This authorizer can check the token claims to determine if the request is coming from a human user or a device and apply appropriate access controls.

This approach allows you to maintain your existing two-user pool structure while incorporating device authentication. It simplifies token validation at the API end since you're still dealing with the same two user pools.

However, there are some considerations:

• You'll need to implement logic in your application to manage device "users" differently from human users.
• Ensure you have a robust system for managing device credentials securely.
• Be mindful of any user pool limits, as adding devices as users will increase the total number of users in your pools.

Remember to implement proper security measures, such as regular credential rotation for devices and monitoring for unusual authentication patterns. This approach provides individual device authentication without significantly complicating your existing architecture.
Sources
Working with user devices in your user pool - Amazon Cognito
DeviceConfigurationType - Amazon Cognito User Pools
User-pool multi-tenancy best practices - Amazon Cognito