Authentication/Cognito SDK not working once deployed to AWS Lambda

Question

I've integrated AWS Cognito User Pools into my app, as outlined in this article: http://snevsky.com/blog/dotnet-core-authentication-aws-cognito using these packages: AWSSDK.Core and AWSSDK.CognitoIdentityProvider.

In my dev environment, it works well: I can call AdminInitiateAuthAsync to authenticate a user, and I can call SignUpAsync to create a new user. Other methods work well too--in my dev environment.

However, when I deploy my code to Lambda, it doesn't work. Specifically, it's hanging on this line:

var response = await cognito.AdminInitiateAuthAsync(request);

Eventually, I get an error in CloudWatch saying Task timed out. However, it doesn't tell me why. Based on my past experience with Lambda and AWS, I assume it's a permissions issue between Lambda and Cognito, but this is just a guess.

A couple things I've tried:

As outlined in the article, I added two dev environment settings: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. However, Lambda won't let you set these specific keys as Environment Variables. So, as a test, I tried setting these explicitly in my code:

var credentials = new BasicAWSCredentials("myAccessKey", "mySecretKey");
var region = RegionEndpoint.GetBySystemName("myRegionId");
var cognito = new AmazonCognitoIdentityProviderClient(credentials, region);

I added admin permissions to the Lambda Execution role.

Any help appreciated.

Vladyslav Usenko Vladyslav Usenko · Accepted Answer · 2019-05-02T20:47:13

A couple things:

You don't need to provision your API keys in lambda code. AWS does it for you, given that your code actually runs in a secured sandbox.
Your cognito user pool actually has a public DNS name, therefore when you hit any API request to it (even via AWS SDK), your traffic goes through public internet. That means that lambda should be able to send traffic to public internet. Given that you face "Task timed out error", the most common case of such error is that you put your function into VPC, but didn't provision a NAT instance/Gateway, Route table rules and necessary security groups to allow lambda to communicate to public internet. If you check your infrastructure setup and will end up seeing that your lambda is in a VPC, make a decision whether you really need it to be there. If you don't, get it out of there and most likely your cognito requests will work immediately. But if you do, you have to configure NAT, security groups and route table records.

Authentication/Cognito SDK not working once deployed to AWS Lambda

1 Answers