Skip to main content

Authentication Flow

AWSops handles authentication using Amazon Cognito + Lambda@Edge + CloudFront.

Cognito Configuration​

ItemSetting
User Poolawsops-user-pool (self-signup disabled)
Sign-inEmail or username
Password Policy8+ characters, upper/lowercase + digits required
OAuthAuthorization Code Grant, OpenID/Email/Profile
Token Validity1 hour
Login UICustom login page (/awsops/login) — Cognito Hosted UI not used
Auth flowUSER_PASSWORD_AUTH (InitiateAuth) via /api/auth

Authentication Flow Details​

  1. Browser navigates to /awsops
  2. CloudFront triggers Lambda@Edge on viewer-request
  3. Lambda@Edge checks for awsops_token cookie → not found/expired
  4. 302 redirect to the custom login page /awsops/login (not Cognito Hosted UI)
  5. User enters email/password → POST /awsops/api/auth (action: login)
  6. Server calls Cognito InitiateAuth (USER_PASSWORD_AUTH) → obtains IdToken
  7. Sets awsops_token HttpOnly·Secure·SameSite=Lax cookie (1 hour)
  8. Authenticated requests then flow through CloudFront → ALB → EC2
  1. Browser sends request with awsops_token cookie
  2. Lambda@Edge validates JWT → valid
  3. Request passes through CloudFront → ALB → EC2

Lambda@Edge​

ItemSetting
Regionus-east-1 (required for Lambda@Edge)
RuntimePython 3.12 (deployed handler; CDK stub is Node.js 20)
TriggerCloudFront viewer-request
FunctionsJWT validation, OAuth2 callback handling, cookie management
Sign Out

HttpOnly cookies cannot be deleted via JavaScript (document.cookie). AWSops deletes cookies server-side via POST /api/auth.