Leaving Doors Unlocked With Cognito

The talk introduces AWS Cognito, the managed service that handles authentication, authorization and user management for web and mobile applications. It explains its two main parts: user pools, which hold user accounts and sign-in flows, and identity pools, which map authenticated users to AWS roles so they can reach AWS resources. The speaker notes that teams often adopt it for applications already hosted in AWS.

Next, the talk covers common misconfigurations. On user pools these include self-registration left open on a sensitive panel, user attributes that can be changed to raise a role to admin, and a client secret exposed in front-end code. On identity pools it covers unauthenticated guest access, overly broad IAM roles for signed-in users, and exposed identifiers. The demonstrations show how an attacker can use a client ID or pool ID seen in traffic or source code to register, sign in, and exchange a token for temporary AWS credentials, sometimes escalating privileges. The speaker stresses that real impact depends on the application's context.

The closing section offers defensive guidance: disable self-registration when it is not needed, make attributes immutable where they should not change, review what the application assumes about attributes, turn off guest access, apply least-privilege IAM policies, and keep configuration IDs out of client code where possible. Reference material and lab walkthroughs are pointed to for further practice, along with a note that Terraform templates would be shared for hands-on work.