‫So the first surveys we will see into Cognito
‫is called Cognito User Pools, or CUP.
‫And, this is a way to create a serverless database
‫for your web and mobile application users.
‫So, what is a serverless database?
‫That means that your users can use, for example,
‫a simple login, their username or their email,
‫and a password combination,
‫to connect into your applications.
‫They can also obviously reset their passwords,
‫we can, thanks to Cognito User Pools,
‫do an email and phone number verification,
‫we can enable multi-factor authentication for our users,
‫and we are able to tell our users they can login
‫with Google, Facebook, or even SAML,
‫so this is called Federated Identities.
‫So this is pretty much the thing you see
‫when you go onto any other website,
‫they ask you to register users,
‫either create a username/password,
‫or login Google, Facebook, or some other way.
‫There is a feature that you can block users
‫if their credentials are compromised elsewhere,
‫so AWS scans the web for compromised credentials,
‫and will let your user knows into Cognito User Pools,
‫and then finally,
‫and then finally, when your users log in
‫with the Cognito User Pool, what they get back from the API
‫is a JWT, so a JSON Web Token.
‫So, in a diagram, what does our Cognito User Pool look like?
‫Well, they're a database of users,
‫so CUP will have its own internal database of users
‫that we can see,
‫and then our mobile applications
‫and our web application can login
‫against our Cognito User Pool,
‫and when they are logged in,
‫the CUP will return to our user,
‫our mobile applications and our web applications,
‫a JSON Web Token, JWT.
‫As I said, we can also provide login with Amazon, or Google,
‫or Facebook, facility into our Cognito User Pools,
‫so we can do Federation
‫through Third Party Identity Providers,
‫and offer a social login through a social identity provider,
‫so login with Google, login with Facebook.
‫We can also integrate more specific
‫identity providers with SAML, or even OpenID Connect,
‫if you're identity provider supports OpenID Connect.
‫So, that's for how CUP works at a high level,
‫then let's talk about the integrations within AWS for CUP.
‫So CUP integrates with the API Gateway
‫and the Application Load Balancer natively,
‫so for the API Gateway, we've seen how that works already,
‫our users will authenticate with our Cognito User Pool,
‫and retrieve the JSON Web Token from it,
‫then they will pass the web token,
‫the JSON Web Token, to the API Gateway,
‫which will evaluate the Cognito Token
‫and make sure that it is valid,
‫and then, allowing us to access our backend,
‫and this is how we provide authentication
‫onto our API Gateway.
‫But, very simply, we can also use
‫an Application Load Balancer,
‫so using Application Load Balancer Listeners and Rules,
‫we are able to authenticate our users
‫against Cognito User Pools, and then once done,
‫we can forward our users to the backend in our Target Group,
‫which could be EC2 instances, Lambda functions,
‫or ECS containers.
‫So that's it for high level of Cognito User Pools,
‫now let's do a hands on in the next lecture,
‫to practice and see how they work in details.