aws-samples/aws-cognito-quicksight-auth

A simple JavaScript frontend and SAM template to spin up a serverless backend, federating Cognito User Pools users to QuickSight.

aws-cognito-quicksight-auth

A simple JavaScript frontend and SAM template to spin up a serverless backend, federating Cognito User Pools users to QuickSight.

Required Tools

• aws cli

Instructions

Get started by cloning the repository then editing some files described with more detail in steps 3-5:

1. Using the AWS CLI, create an S3 bucket in the same region where you want all resources to be deployed:

aws s3 mb s3://<bucket-name> --region <AWS Region>

2. Package the template with the following command and execute the resulting 'aws cloudformation deploy' output using the AWS CLI, referring to the S3 bucket created earlier:

aws cloudformation package --template-file quicksight.yaml --output-template-file quicksight-output.yaml --s3-bucket <S3 Bucket> 

The next command should be something similar to:

aws cloudformation deploy --template-file /Users/<full path>/quicksight-output.yaml --stack-name CognitoQuickSight --capabilities CAPABILITY_IAM

CloudFormation will automatically create and configure the following resources in your account:

• CloudFront distribution
• S3 static website
• Cognito User Pools
• Cognito Identity Pools
• IAM Role for Authenticated Users
• API Gateway API
• Lambda Function

You can follow the progress of the stack creation from the AWS Console in CloudFormation. When the status of the “CognitoQuickSight” stack is CREATE_COMPLETE, execute the following command with the AWS CLI:

aws cloudformation describe-stacks --query 'Stacks[0].[Outputs[].[OutputKey,OutputValue]]|[]' --output text --stack-name CognitoQuickSight

3. Either refer to the output of the "describe-stacks" command above or go to the CloudFormation console, select the stack created on item 2 and open the OUTPUTS tab. All resources we'll need will be there. Use the information to fill up the details in the file "auth.js" including the region.

4. In the AWS Console, go to the Cognito User Pools section and select the pool named QuickSightUsers generated by CloudFormation. Under APP INTEGRATION -> DOMAIN NAME, create a Domain (be mindful domain names are unique to the region) and add the domain to the “auth.js” file accordingly.

5. Under APP INTEGRATION -> APP CLIENT SETTINGS select the option COGNITO USER POOL. Add the CloudFront distribution address (with https://, as SSL is a requirement for the callback/sign out URLs) and make sure that the address matches the related settings in the “auth.js” file exactly. For ALLOWED OAUTH FLOWS, select IMPLICIT GRANT. For ALLOWED OAUTH SCOPES, select OPENID.

6. Upload the four JS and HTML files from the root folder to the S3 bucket named “cognitoquicksight-s3website-xxxxxxxxx”. Make sure that all files are publicly readable.

7. Access the CloudFront distribution address from a browser to authenticate and access QuickSight

aws-cognito-quicksight-auth's Issues

confused deputy

does this code suffer from the confused deputy vulnerability?

it looks as though the frontend sends an arbitrary URL to a lambda, which then requests it and returns the payload, without any sanitisation 🤔

aws-cognito-quicksight-auth/lambda/index.js

Line 5 in 57ec754

unirest.get(event.body)

Uncaught TypeError: AWSCognito.CognitoIdentityServiceProvider.CognitoAuth is not a constructor

I am trying to follow your sample to build quicksight with cognito, but I get this error message when I access the static website

Uncaught TypeError: AWSCognito.CognitoIdentityServiceProvider.CognitoAuth is not a constructor

I had already involved aws-cognito-sdk.js and amazon-cognito-auth.min.js

Missing styles

aws-cognito-quicksight-auth/index.html

Line 9 in acf7847

<link rel="stylesheet" type="text/css" href="style.css">

codeUri

aws-cognito-quicksight-auth/quicksight.yaml

Line 124 in acf7847

CodeUri: ./lambda.zip

I'm getting a cloudformation error related to "CodeUri"
This works..

      CodeUri: 
        Bucket: bucket-name
        Key: lambda.zip

Cognito error

Failed to create the changeset: Waiter ChangeSetCreateComplete failed: Waiter encountered a terminal failure state Status: FAILED. Reason: Template format error: Unrecognized resource types: [AWS::Cognito::UserPool, AWS::Cognito::IdentityPoolRoleAttachment, AWS::Cognito::UserPoolClient, AWS::Cognito::IdentityPool]

IAM Role use

Hi - not an issue maybe but guidance, please. All works fine but I am using groups created in the User Pool in the claim of the Identify Pool Authentication provider (new role with rules). The default as provided in the stack works fine, but I'm battling to get a member of a group to login to Quicksight and see either dashboards specified as a resource or dashboards published to a group which is again specified in the IAM permissions. e.g. of IAM policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Action": "quicksight:CreateReader",
"Effect": "Allow",
"Resource": ""
},
{
"Action": "quicksight:CreateGroupMembership",
"Effect": "Allow",
"Resource": "arn:aws:quicksight:::group/default/"
}
]
}

I've changed this around a few times to use only the groupmembership action, RegisterUser and specified the dashboard ARN for resource without success. This may be me missing something on IAM knowledge but if it is please let me know!

blog url

The big-data blog post url no longer exists - does it live anywhere else ? Thanks

Can not getUserAttributes and updateUserAttributes

We used these library.

 <script src="aws-cognito-sdk.js"></script>
 <script src="amazon-cognito-auth.min.js"></script>

We got the error below.

Uncaught TypeError: cognitoUser.getUserAttributes is not a function

cognitoUser.getUserAttributes(function(err, result) {
        if (err) {
            alert(err);
            return;
        }
        userData = result;
    });

We followed the document

It seems that current library does not support getUserAttribute. Is there any possible way to get or update userAttribute?

Token expired or invalid signing out

Hi,
I have followed all mentioned steps to integrate AWS cognito to one end point (e.g, "https://google.com")
After finishing configuration part, I was successfully got opened out cloudFrount link for creating account, but I'm getting message like Token expired or invalid signing out! while signing up.

Please help me to solve this issue.

Not able to use specific user id token

Hi all,

How do I get the specific username of the person who logged in? Currently, it is showing on Quicksight as 'RoleName/CognitoCredentials'. Every cognito user that exist in my user pool can access this unique quicksight user using '/CognitoCredentials'.

For example, let's suppose that my cognito user pool has two users "user1" and "user2" and I want to restrict some dashboards for them. When "user1" or "user2" is logged in, the quicksight user is 'RoleName/CognitoCredentials'. In other words, the same quicksight user is accessed by the two cognito users and it is not possible to restrict dashboards for them.

Actually what I really wanna do is to have one Quicksight user for each Cognito user. It should be something like 'RoleName/UserCredentials' and not be using the cognito user pool credentials.

Is that possible? How can I use the user credentials (id token)?

Please, your prompt reply is highly appreciated.

Regards,
Bruno