JA EN
shiichan

Amazon Cognito Can Now Import Users With Their Password Hashes Intact!

AWS What's New ★★★★ View Markdown
#aws#security

Hey there, it's Shiichan! I found a small but genuinely useful update around user migration today!

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, Amazon Cognito now supports bringing password hashes along when you import users through a CSV file.

The story so far

Until now, users imported from a CSV file always had to reset their password on first sign-in. There was no way to carry over the actual password from your source system, so every migration meant prompting all your users to reset — a small but real annoyance.

What changes

With this update, you can specify the password hashing algorithm your source system used when you create the CSV import. Cognito imports those hashes and verifies the user's password against them on first sign-in. That means users can sign in with their existing password right away, with no reset required.

For the team running the migration, the big win is not having to ask every user to go through a password reset flow.

Dive Deep

Four hashing algorithms are supported:

  • bcrypt
  • scrypt
  • Argon2id
  • PBKDF2 with SHA-256

Imported hashes get an additional layer of cryptographic protection before they're stored, so the security side is covered too.

This is available in all AWS Regions where Amazon Cognito is available, and you can set it up from the AWS Management Console, the AWS CLI, or the AWS SDKs.

Wrap-up

  • Amazon Cognito's CSV user import can now carry over password hashes directly
  • Supported algorithms are bcrypt, scrypt, Argon2id, and PBKDF2 with SHA-256
  • Migrated users can sign in right away with no password reset required
  • Imported hashes get an extra layer of cryptographic protection
  • Available in every Region where Cognito runs

If your team has been planning a migration to Cognito, this lowers the bar considerably!

Related posts