Skip to content

AWS AppSync Events API & Authorizer mode as Amazon Cognito User Pool

0

Hello,

AppSync Events API Authorizer mode "Amazon Cognito User Pool" (AWS AppSync => APIs => [API name] => Settings => Authorization configuration => Authorization modes)

Using "Amazon Cognito User Pool" for AppSync Events API Authorizer mode, while using cognito pool from same account(by selecting cognito user pool from dropdown on console) where AppSync resource available its working fine. While trying to use Cognito pool from different AWS account(using full ARN), it always gives UnauthorizedException , does AppSync Events API support to cross account Cognito user pool OR i am missing anything else here?

Reference: https://docs.aws.amazon.com/appsync/latest/eventapi/configure-event-api-auth.html#amazon-cognito-user-pools-authorization

1 Answer
0

Based on the available information, while AWS AppSync Events offers Amazon Cognito user pools as one of its authorization types, there is no explicit documentation indicating that cross-account Cognito user pools are supported for AWS AppSync Events APIs.

This differs from Amazon API Gateway, which specifically supports using Amazon Cognito user pools from different AWS accounts as API authorizers. API Gateway documentation clearly states that you can use a Cognito user pool from a different AWS account as your API authorizer, making it easy to centrally manage and share a central Cognito user pool authorizer across multiple APIs.

For AWS AppSync Events API, the documentation only mentions that Amazon Cognito user pools authorization implements group-based access control using Amazon Cognito's user management features. It requires including the OIDC token in the Authorization header with each request, but doesn't specifically address cross-account scenarios.

The UnauthorizedException you're experiencing when trying to use a Cognito pool from a different AWS account suggests that AWS AppSync Events API might not support cross-account Cognito user pools in the same way that API Gateway does. You might need to use a Cognito user pool from the same AWS account as your AppSync Events API, or consider alternative authorization methods if cross-account authorization is required.
Sources
Configuring authorization and authentication to secure Event APIs - AWS AppSync Events
Configure cross-account Amazon Cognito authorizer for a REST API using the API Gateway console - Amazon API Gateway

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.