Integrations
Integrations
Breadcrumbs

AWS Cognito

This module allows Anjana Data to synchronize the users of an Amazon Cognito User Pool.

The process uses the standard AWS API (ListUsers) to periodically download the full user directory. All user attributes (standard and custom) are available for field mapping.

Part 1: Configuration in AWS (IAM User)

Anjana needs programmatic credentials (Access Key / Secret Key) with specific read permissions to access the User Pool.

Step 1: Create IAM User

  1. Go to the IAM (Identity and Access Management) console in AWS.

  2. Select Users > Create user.

  3. Assign a name (e.g. anjana-cognito-sync).

  4. Complete the creation without granting console access.

  5. Go to the Security credentials tab > Access keys > Create access key.

  6. Select "Local code" or "Third-party application".

  7. Important: Copy and save the Access Key and the Secret Key.

Step 2: Create Permissions Policy

It is recommended to restrict access solely to the User Pool you want to synchronize.

  1. On the IAM user, add an Inline Policy or create a managed policy.

  2. Use the following JSON, replacing the Resource with the ARN of your User Pool (or use * to grant access to all pools in the account):

YAML
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CognitoReadAccess",
            "Effect": "Allow",
            "Action": [
                "cognito-idp:ListUsers",
                "cognito-idp:AdminGetUser"
            ],
            "Resource": "arn:aws:cognito-idp:eu-west-1:123456789012:userpool/eu-west-1_AbCdEfG"
        }
    ]
}

Part 2: Get User Pool Data

  1. Go to the Amazon Cognito console.

  2. Access the User Pool you want to connect.

  3. In the header of the "Overview" page, copy the User Pool ID.

    • Example: eu-west-1_XyZ123

  4. Note the Region where it is deployed (e.g. eu-west-1).

Part 3: Configuration in application.yml

Edit Anjana's configuration file and include the data in the security.provisioning.providers.aws-cognito section.

YAML
security:
  provisioning:
    providers:
      aws-cognito:
        # Unique key to identify this data source (e.g.: pool-clientes-externos)
        pool-clientes:
          # AWS Region of the User Pool
          region: "eu-west-1"
          # User Pool ID (obtained in Part 2)
          user-pool-id: "eu-west-1_XyZ123456"
          # IAM User credentials (created in Part 1)
          access-key: "AKIAXXXXXXXXXXXXXXXX"
          secret-key: "SECRET_KEY_XXXXXXXXXXXXXXXXXXXXXXXX"

Properties Summary

Use this table to quickly locate the values needed in the AWS console.

YAML Property

Description

Source in AWS

access-key

Access key ID of the technical user.

IAM > Users > Security credentials

secret-key

Access key secret.

IAM > Users > Security credentials (Only visible when created)

region

Code of the region where the service is located.

AWS Console (Top right corner)

user-pool-id

Unique identifier of the directory.

Amazon Cognito > User Pools > Overview

Custom field mapping (field-mapping)

Anjana includes a default mapping that covers the usual cases. You can override any field by indicating the Cognito attribute key from which the value should be read. The keys are listed in order of priority: the first non-empty value is used.

Default mapping

Anjana Field

Default keys (priority order)

userName

preferred_username, email

email

email

firstName

given_name, name

lastName

family_name

phone

phone_number

title

custom:title

Available fields

Anjana exposes all Cognito user attributes (both standard and custom), so any key can be used in field-mapping.

Key

Description

sub

Unique, immutable identifier of the user.

email

Email address.

email_verified

true if the email is verified.

phone_number

Phone number (E.164 format, e.g. +34612345678).

name

Full name.

given_name

First name.

family_name

Last name.

middle_name

Middle name.

nickname

Nickname.

preferred_username

Preferred username (login).

profile

Profile URL.

gender

Gender.

birthdate

Date of birth.

zoneinfo

Time zone (e.g. Europe/Madrid).

locale

Locale setting (e.g. es_ES).

custom:*

Any custom attribute of the pool (e.g. custom:title, custom:department).

Configuration example

YAML
security:
  provisioning:
    providers:
      aws-cognito:
        pool-clientes:
          region: "eu-west-1"
          user-pool-id: "eu-west-1_XyZ123456"
          access-key: "..."
          secret-key: "..."
          field-mapping:
            # Read job title from the custom attribute 'custom:position'
            title: ["custom:position", "custom:title"]
            # Read department from the attribute 'custom:department'
            # (there is no Anjana field for department, but it can be used as a fallback in title)
            phone: ["phone_number"]