Amazon Cognito iOS

Question

I'm trying to integrate Amazon Web Services into my application, but frankly, it was a serious problem and it is very annoying.

I am using the Amazon SDK (V2.1.0) for iOS, and this is what I am trying to achieve:

• In my application, I have a registration screen where my users can register for my application using either Facebook or creating an account
• If the user wants to create an account, I plan to use Amazon Cognito to securely access Amazon DynamoDB (through the iOS application), where I will store the email address and password.

I am trying to get Amazon Cognito to work with the following code in my ViewController, but I get zero for the cognitoId variable. My code is below:

AWSCognitoCredentialsProvider *credentialsProvider = [[AWSCognitoCredentialsProvider alloc] initWithRegionType:AWSRegionUSEast1 identityPoolId:@"us-east-1:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX"]; AWSServiceConfiguration *configuration = [[AWSServiceConfiguration alloc] initWithRegion:AWSRegionUSEast1 credentialsProvider:credentialsProvider]; AWSServiceManager.defaultServiceManager.defaultServiceConfiguration = configuration; NSString *cognitoId = credentialsProvider.identityId; //NULL 

Based on everything that I explained above, I have the following questions:

• Is my Amazon Cognito usage example correct in this scenario?
• Why does the code not work?
• I think the problem may be related to iam roles configured in the identifier pool. I am not sure what roles should be given in terms of security. After users have registered, the application will receive write permission to my DynamoDB without exposing the security vulnerability. Can anyone tell about this?

I appreciate anyone who can help. I'm losing my mind trying to get this to work the last couple of days.

Thanks!

Answer 1

The default Cognito identifier is not set. Are you calling getIdentityId or are you updating with your provider? If not, I will try this and see if the result works.

For your other questions, Cognito supports "public providers" such as facebook, google and amazon, as well as authenticated developer identifiers. For your proposed case with facebook, you can pretty easily use Cognito. A blog post about Cognito roles and policies is available here .

Authenticated developer identifiers can be a valid (and more secure) way to implement your second use case. The workflow will require that you have a back panel server, but you could only provide access to the dynamo db table to that server. Users must be logged in, the application will send this data to your server, this server will check and respond with credentials, and then the user can access your other AWS resources. A blog post describing roles and policies in this context is available here , and one gives more detailed information about the specifics and listing of the end to end is available here .