DEV Community

Cover image for Securing APIs with AWS Amplify and Cognito
Chetan Pawar
Chetan Pawar

Posted on

Securing APIs with AWS Amplify and Cognito

Securing APIs with AWS Amplify and Cognito

We are hiring!


AWS Amplify is one of the fastest ways to help front-end web and mobile developers build full stack applications, hosted in AWS.

In the first part of this blog series, Using Amplify for REST APIs and Web hosting we built an API using AWS Amplify to quickly setup and host an API with minimal coding.

In this part we build an authentication system for the API using Amazon Cognito.

Amazon Cognito lets us add user sign-up, sign-in, and access control to our web and mobile apps quickly and easily. It is highly scaleable and supports sign-in with social identity providers, such as Facebook, Google, and Amazon, and enterprise identity providers via SAML 2.0.


  • Secure and scalable user directory

  • Standards-based authentication

  • Security for your apps and users

  • Easy integration with our App

What to Build ?

In this Blog we quickly build an authentication system for a simple REST API using AWS Amplify CLI.

We will build

  • An authenticated ExpressJS server that returns a random number


  • Amplify CLI — Open terminal and run npm install -g @aws-amplify/clito update to the latest Amplify CLI.

  • Amplify CLI configured — If you have not configured the Amplify CLI yet, follow this guide in the documentation.

Setup a new Amplify project

  • Run the following command to create a new Amplify project called “amplify-rest-containerized” or if you already have an existing Amplify project skip to the next section.
mkdir amplify-rest-containerized
cd amplify-rest-containerized
Enter fullscreen mode Exit fullscreen mode
  • Initialize an Amplify project by running:
    amplify init
Enter fullscreen mode Exit fullscreen mode

For a quick implementation, we can just accept the default values in the amplify init workflow console.

Enable container based deployments

  • Container-based deployments need to be explicitly enabled. Run amplify configure project to review your project configuration:
    amplify configure project
Enter fullscreen mode Exit fullscreen mode
  • Accept the defaults and answer Yes when asked if you want to enable container-based deployments:
    ? Do you want to enable container-based deployments? Yes
Enter fullscreen mode Exit fullscreen mode

Add an authenticated container-based ExpressJS API

For the demo, let’s quickly create a REST API. More detailed explanation can be found here

  • To create our authenticated container-based REST API, execute:
    amplify add api
Enter fullscreen mode Exit fullscreen mode
  • Choose the following options:
? Please select from one of the below mentioned services: REST
    ? Which service would you like to use API Gateway + AWS Fargate (Container-based)
    ? Provide a friendly name for your resource to be used as a label for this category in the project: container622e561f
    ? What image would you like to use ExpressJS - REST template
    ? When do you want to build & deploy the Fargate task On every "amplify push" (Fully managed container source)
    ? Do you want to restrict API access Yes
    Successfully added auth resource locally.
    Successfully added resource container622e561f locally.
Enter fullscreen mode Exit fullscreen mode
  • After a successful completion of the CLI workflow, we’ll see these new files added to the project folder structure.
    ├── amplify.state
    ├── containerb5734e35-cloudformation-template.json
    ├── parameters.json
    └── src
        ├── Dockerfile
        ├── DynamoDBActions.js
        ├── buildspec.yml
        ├── index.js
        ├── package-lock.json
        └── package.json

    ├── cognitod17bb34c-cloudformation-template.yml
    └── parameters.json
Enter fullscreen mode Exit fullscreen mode
  • In the src/index.js we will find a starter ExpressJS source code to interact with DynamoDB.
    Let’s edit that to return a random number.

  • Replace the index.js file with the following code:

    const express = require("express");
    const bodyParser = require('body-parser');
    const port = process.env.PORT || 3001;const app = express();
    app.use(bodyParser.urlencoded({ extended: true }));// Enable CORS for all methods
    app.use(function (req, res, next) {
        res.header("Access-Control-Allow-Origin", "*")
        res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept")
    });app.get("/", async (req, res, next) => {    try {
                "randomNumber": Math.floor(Math.random() * 101) 
        } catch (err) {
    });app.listen(port, () => {
        console.log('Example app listening at [http://localhost:'](http://localhost:') + port);
Enter fullscreen mode Exit fullscreen mode


  • Now let’s deploy our API:
    amplify push
    ✔ Successfully pulled backend environment dev from the cloud.

    Current Environment: dev

    | Category | Resource name     | Operation | Provider plugin   |
    | -------- | ----------------- | --------- | ----------------- |
    | Auth     | cognitod17bb34c   | Create    | awscloudformation |
    | Api      | container622e561f | Create    | awscloudformation |
    ? Are you sure you want to continue? Yes
Enter fullscreen mode Exit fullscreen mode
  • As we see amplify also deploys authentication related resources.

What’s happening under the hood ?

  • We are deploying an API just like the first blog

  • Adding authentication related resources like AWS Cognito User Pool, Identity Pool, User Pool Client, Client Role, Authorizer Lambda function

  • Amplify uses a Nested CloudFormation Stack to deploy each component from the App. In this example, it would deploy a network stack, a cognito resources stack and a containerized API stack.

Test our containerized and authenticated ExpressJS API

This is where we come to the tricky part.

There are several ways in which we can interact with AWS Cognito APIs to get the necessary authentication token for getting access to the API.

  • AWS SDK for JavaScript to include components in your code to obtain token using pre-built UI components in React.

  • AWS CLI commands to perform sign-up for a user, confirm the user registration and request for generating a token for authentication.

For quick testing, we would use the AWS CLI generated token for authenticating our request to the API.

Pre-requisites to generate Token

You would need the following information before you start the process

  • The AppClient-ID for the AWS Cognito User Pool — This can be obtained from AWS Console for AWS Cognito or from the CloudFormation Stack Resources Details Tab

  • The UserPool-ID for the AWS Cognito User Pool — This can be obtained from AWS Console for AWS Cognito or from the CloudFormation Stack Resources Details Tab

How to generate the token ?

  • Create a Sign-up request for the required User
    aws cognito-idp sign-up --region <region> --client-id <client_id> --username --password xxxx --user-
    attributes Name="email",Value=""

    Response :
        "UserConfirmed": false,
        "CodeDeliveryDetails": {
            "Destination": "",
            "DeliveryMedium": "EMAIL",
            "AttributeName": "email"
        "UserSub": "0bf218e6-65ab-4160-8ae9-48bb4e9f22cd"
Enter fullscreen mode Exit fullscreen mode
  • Confirm the registration of the User
    aws cognito-idp admin-confirm-sign-up --region <region> --user-pool-id <user_pool_id> --username
Enter fullscreen mode Exit fullscreen mode
  • The password set for the new user in Step 1 is temporary and it needs to be changed before generating the authentication request
    aws cognito-idp initiate-auth \
            --client-id <client_id> \
            --auth-flow USER_PASSWORD_AUTH \
            --auth-parameters ",PASSWORD=xxxxxxxx"


        "ChallengeName": 'NEW_PASSWORD_REQUIRED',
        'ClientId' => '<client_id>',
        'Session' => <session_token>,
Enter fullscreen mode Exit fullscreen mode
  • Use the session_token from the above response to set the new password
    aws cognito-idp respond-to-auth-challenge --client-id <client_id> --challenge-name NEW_PASSWORD_REQUIRED --challenge-responses,NEW_PASSWORD="xxxxxxxx" --session "<session_token>"
Enter fullscreen mode Exit fullscreen mode
  • The above request responds with the Tokens generated after successful authentication with AWS Cognito
        "ChallengeParameters": {},
        "AuthenticationResult": {
            "AccessToken": "xxxxxxxxxxxxxxxxxxx",
            "ExpiresIn": 3600,
            "TokenType": "Bearer",
            "RefreshToken": "xxxxxxxxxxxxxxxxxxx",
            "IdToken": "xxxxxxxxxxxxxxxxxxx"
Enter fullscreen mode Exit fullscreen mode
  • Finally we can use the AccessToken to test our API

Testing the API

The best way to demonstrate the authenticated API is from the Postman App using Authentication.

  • Setup authentication parameters in Postman App — Enter the AccessToken in the Token section.

  • Execute the request to the API

The API endpoint is printed at the end of the “amplify push” command or when you execute “amplify status”.

Note: This is a simple use case just to showcase the workflow.
We used the AWS CLI to quickly demonstrate the authentication flow. However, actual authentication for your app should be done seamlessly using the appropriate AWS SDK for your code.
Review Amplify documentation if you’re interested in any other scenario.

What did we learn ?

This blog post gives a quick way to deploy an authenticated API using Amplify CLI.

  • Quickly setup and authenticated API using AWS Amplify

  • How to authenticate the requests to the authenticated API using AWS CLI

There is so much more to explore.

Keep building…

We are hiring!

Top comments (0)