Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Which is the best way to authorize users from an external app to access AWS services such as Rekognition?

0

Hi, I am almost completely new to AWS and to this forum. It's a while I am trying to implement, for an application I am building with a no code platform called Bubble.io, a user identity verification that relies on the AWS cloud. The case scenario is quite common. During onboarding, my users will:

  • register on my app by using their email and choosing a password (or through the Gmail sso);
  • if they used the email/passord route, verify their email;
  • verify their identity by comparing their identity document with selfie. I have seen this AWS post:

https://aws.amazon.com/it/blogs/machine-learning/accelerate-your-identity-verification-projects-using-aws-amplify-and-amazon-rekognition-sample-implementations/

and roughly that is what I am trying to realize. Anyway with some differences. The main one is that my front end is built and is served by the Bubble platform. Instead the flow shown in the linked article supposes the use of a client app that resides and is deployed with AWS Amplify. Furthermore it seems that to use the face liveness api of Rekognition (i.e. the service that finds fraud attempts of a user who is trying to send another face picture before their actual selfie), one should use the Face liveness detector React UI component that is delivered by AWS Amplify itself. This because the Face liveness detector component interacts with Rekognition during the Face session (or, at least, this is what I got from AWS documentation). Now, Bubble lets you integrate your app with other systems through API and lets you build new functionalities/elements by building plugin. And I have discovered this article that explain how to use an external deployed React component into a Bubble plugin:

https://medium.com/numatic-ventures/how-to-incorporate-reactjs-component-in-custom-element-in-bubble-io-part-1-fde3a83c039c

With that, my idea would be to:

  • deploy the Face Liveness detector with Amplify on AWS
  • using the Bubble plugin to "bring" the Face Liveness Detector component inside my Bubble app

But now I have this doubt/problem (or essentially lack of AWS knowledge). Considering that my users will be registered and authenticated through the Bubble platform inside my app, when they will reach the step to send their selfie, they won't have any authorization in the AWS cloud, and, in particular, no authorization to start the Face liveness session with AWS Rekognition. And,a s a matter of fact, the Face Liveness Detector component docs state that Amplify must authenticate users to start the session.

https://ui.docs.amplify.aws/react/connected-components/liveness#step-1-configure-auth

So, I would like that, once my users authenticate inside my Bubble app and reach the step to send their selfie, they get automatically (without any need to re send any kind of credentials) the authorization (token?) in order Amplify can authorize them to start the api session with Rekognition. In the last linked docs I have read that Amplify, by default, use AWS Cognito to authenticate users. But this, in my opinion, is the scenario where my users data are in the AWS cloud and, if I am not wrong, they are a user pool of AWS Cognito. Always in the last linked document, it is also stated that one could use Amazon STS to get an authorization token. This sounds to me a little more close to what I need: i.e., my app get (or has) an authorization token and pass (or borrows) it to the users who need to go through the identification process. I have also read that Cognito support Identity pool, but I am not sure if this could be an option (or could be part of a solution). And finally, I am aware of the IAM service, but, again, I am not sure how I could use them to get my desired behaviour (if possible). At this point I am stuck because, as I mentioned above, I am quite new to AWS and I have a lot of lacks in its knowledge and that is why I am here asking for someone help/tips on how to proceed.

Thank you very much to everyone in advance. Federico

Topics
Front-End Web & MobileMachine Learning & AISecurity, Identity, & ComplianceNetworking & Content Delivery
Tags
Amazon RekognitionAmazon API GatewayAmazon CognitoSecurity, Identity, & ComplianceAWS Amplify
Language
English

asked 2 years ago427 views

1 Answer
0

To authorize users from an external app like your Bubble.io application to access AWS services such as Amazon Rekognition, the best approach would be to use Amazon Cognito with identity pools. This solution is well-suited for your scenario and provides a secure way to grant temporary, limited-privilege AWS credentials to your users.

Here's how you can implement this:

  1. Set up an Amazon Cognito identity pool. This pool can support both authenticated and unauthenticated users.

  2. Configure your Bubble.io app as an external identity provider for the Cognito identity pool. This allows users authenticated by your Bubble.io app to obtain temporary AWS credentials.

  3. When a user authenticates in your Bubble.io app and needs to access AWS services (like Rekognition for face liveness detection), your app would request temporary AWS credentials from the Cognito identity pool.

  4. Use these temporary credentials to make API calls to AWS services on behalf of the user.

This approach allows you to maintain user authentication in your Bubble.io app while securely accessing AWS services. It eliminates the need for users to separately authenticate with AWS, providing a seamless experience.

For the Face Liveness Detector component, you can still use it by deploying it with AWS Amplify and incorporating it into your Bubble.io app as you described. The key is to pass the temporary credentials obtained from Cognito to this component when initializing it.

To implement this:

  1. Create an IAM role with the necessary permissions to access Rekognition and other required AWS services.

  2. Associate this role with your Cognito identity pool.

  3. In your Bubble.io app, when you need to use AWS services, request temporary credentials from Cognito.

  4. Pass these credentials to your React component (Face Liveness Detector) when you initialize it in your Bubble.io plugin.

This solution allows you to maintain your user management in Bubble.io while securely accessing AWS services, providing a smooth, integrated experience for your users without requiring them to reauthenticate or manage separate AWS credentials.

Remember to properly secure your application and follow AWS best practices for handling credentials and permissions.
Sources
Common Amazon Cognito scenarios - Amazon Cognito
Access to externally authenticated users (identity federation) - AWS Identity and Access Management
Amazon Rekognition – frequently asked questions - AWS

answered 2 years ago

  • Federico
    2 years ago

    Thank you. But it is not clear to me how I can apply the point 2 and 3 (of the first list in your answer), i.e. how I can configure my Bubble.io app as an external identity provider for the Cognito identity pool and how my app would request temporary AWS credentials from the Cognito identity pool.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content