AWS Lambda Security - Default Access to Cognito?

Question

I recently wrote a simple Lambda function to signup a new user to AWS Cognito. I left the execution role for the function as the default AWSLambdaBasicExecutionRole which only has limited access to CloudWatch.

As such, I expected to receive an error when running my function saying something along the lines of "Your function is not authorized to access Cognito, etc..." However, I was surprised to see that the function ran successfully.

Here is my function code (Node.js 10.x):

const AWS = require("aws-sdk");
const crypto = require("crypto");

const Cognito = new AWS.CognitoIdentityServiceProvider();

exports.handler = async (event) => {
  const clientId = process.env.COGNITO_CLIENT_ID;
  const clientSecret = process.env.COGNITO_CLIENT_SECRET;
  const {username, password, email} = event;

  const secretHash = crypto.createHmac("SHA256", clientSecret).update(email + clientId).digest("base64");

  const params = {
    ClientId: clientId,
    SecretHash: secretHash,
    Password: password,
    Username: username,
    UserAttributes: [
        {
            Name: "email",
            Value: email
        }    
    ]
  };

  try {
      const authRes = await Cognito.signUp(params).promise();
      return {
          data: authRes
      }
  } catch(err) {
      console.log("Error: ", err);
      return {
          err
      }
  }
};

And here is the IAM policy for the function's execution role:

{
  "Version": "2012-10-17",
  "Statement": [
      {
        "Effect": "Allow",
        "Action": "logs:CreateLogGroup",
        "Resource": "arn:aws:logs:us-east-1:<account_id>:*"
      },
      {
        "Effect": "Allow",
        "Action": [
            "logs:CreateLogStream",
            "logs:PutLogEvents"
        ],
        "Resource": [
            "arn:aws:logs:us-east-1:<account_id>:log-group:/aws/lambda/create_user:*"
        ]
      }
  ]
}

So why is my Lambda function able to access Cognito? Doesn't this pose a huge security risk since Lambda is not supposed to have any implicit permissions?

If someone could explain this, it would be very much appreciated

Ninad Gaikwad Ninad Gaikwad · Accepted Answer · 2019-07-17T09:53:50

Cognito APIs are divided into two types. Signed and unsigned. The API that you are using (signUp) is an unsigned API and therefore cannot be restricted by IAM policy.

Basically all the admin calls like adminsignup where you can sign someone up for your service can be restricted, but the call you are making is designed for when users are registering themselves for your service. Restricting that API in IAM would not be very useful.

You can see all the unsigned APIs here

AWS Lambda Security - Default Access to Cognito?

1 Answers