JA EN
shiichan

Amazon Cognito goes multi-Region so your sign-ins never stop!

AWS Blog ★★★★ View Markdown
#aws#security#infrastructure

Hi everyone, it's Shiichan! Today I found an update that makes authentication feel a lot more reassuring, so let me share it with you.

AWS Blog aws.amazon.com

What was announced?

On the AWS Blog, Amazon Cognito got multi-Region replication. Alongside it, support for customer-managed keys (CMK) for encryption arrived too.

This feature keeps a synchronized copy of your user pool data and machine secrets in a secondary AWS Region. If something happens to your primary Region, you can shift to the secondary one and keep authentication going.

The story so far

Until now, building something that keeps authentication running across Regions was pretty tough.

  • You had to build and maintain your own replication to sync configurations
  • Exporting/importing user data by hand created security risks and inconsistencies
  • Switching Regions forced users through password resets and re-authentication
  • For machine-to-machine (M2M) traffic, you had to recreate and reconfigure app clients in the secondary Region

In other words, it worked, but everyone had to sweat through it by hand.

What changes

The best part is that even after a failover, users can sign in just like before.

Existing users can continue signing in with their existing credentials without disruption

And because both Regions recognize access tokens issued by either one, users who are already logged in stay authenticated. Federated sign-in (Amazon, Google, Apple, Facebook), SAML and OIDC integrations, and API authorization flows are all covered.

Dive Deep

Under the hood, replication is one-way from primary to secondary, and the secondary is read-only. So this isn't active-active; think of it as a setup that takes over authentication when you need it.

Because of that, there are a few things to watch out for during failover.

Operations like new user registration or profile updates are not available during failover.

So new user registration and profile updates take a break during a failover.

Here's what you'll want to know to get started.

  • Prerequisite: you need a multi-Region customer-managed KMS key ready first.
  • Supported tiers: Essentials and Plus.
  • Setup is three steps: configure the KMS key, then set up multi-Region OIDC endpoints (which need application updates), then pick the target replica Region.
  • Failover is mostly something you monitor yourself and trigger via DNS. If you use managed login and federation with custom domains, you can hand over an Amazon Route 53 health check ID to get built-in traffic routing.

Supported Regions include US East (Ohio, N. Virginia), US West (N. California, Oregon), Asia Pacific (Mumbai, Seoul, Singapore, Sydney, Tokyo), Canada (Central), Europe (Frankfurt, Ireland, London, Paris, Stockholm), and South America (São Paulo). Tokyo being on the list is nice for folks in Japan.

On pricing, you're billed per replica Region. Per monthly active user (MAU), Essentials is $0.0045 and Plus is $0.006. M2M authentication adds a 30% surcharge on top of the usual volume-based pricing for successfully issued tokens.

Wrap-up

  • Amazon Cognito now supports multi-Region replication, syncing one-way from primary to secondary.
  • During a failover, users keep signing in with their existing credentials, and both Regions recognize each other's access tokens.
  • But the secondary is read-only, so new registrations and profile updates aren't available during failover.
  • The prerequisite is a multi-Region KMS key; supported tiers are Essentials and Plus, and pricing is per-MAU per replica Region.

This one's a great fit for teams that want higher authentication availability against Regional outages, or anyone whose regulations call for a multi-Region setup!

Related posts