I’ve gone through several posts in here, but couldn’t find any that would relate to my setup, maybe the setup is bad, so i’m open to suggestions.
I’m currently trying to execute such workflow:
User registers on website.com, they are stored in main-user-pool (cognito), they are then able to create a company(tenant) and that executes a cloudformation stack which creates a user pool for the tenant alongside some other resources.
The issue that i’m having is – how can a creator of company(tenant-admin) have access to administer the tenant-user-pool? I would like the admins to have the ability to sign in from main-user-pool, because there might be cases where one user can have multiple companies and having separate logins for each tenant seems like a hassle.
Regarding the tenant-user-pool, it will store users for that specific tenant, such as employees, tenant administrators and so on.
Once the tenant owner signs in to website.com, i want them to able to see all their companies and have the ability to sign into tenant.website.com (which uses tenant-user-pool).
I have tried creating separate identity pools as well, but not sure if that’s the right approach.
Hopefully my question and concern is understandable, thanks in advance for any suggestions!
Option 1: Use AWS Cognito Identity Pools and Roles:
- Create an Identity Pool linked to the main user pool, and configure
it to use the main user pool’s ID tokens. - Set up roles (like TenantAdminRole) in the Identity Pool that allow
specific access to the AWS resources needed (e.g., the tenant user
pool). - When the tenant admin signs in to website.com, they get a set of AWS
credentials via the identity pool, granting them access to administer
the tenant’s user pool and other resources.
Option 2: Cross-Account Cognito User Pool Access:
- You can configure Cognito user pools to allow cross-account access by
using AWS IAM roles and policies. - Set up IAM roles that grant access to the tenant’s Cognito User Pool
and assign them to tenant admins. - When a tenant admin is authenticated using the main user pool, they
assume a role (e.g., via AWS STS AssumeRole) to access and manage the
tenant user pool.