Amazon Cognito Managed Login integration with AWS WAF | Amazon Web Services

Key Takeaways

Are you looking to protect your cognitive login pages from common web exploits? Are you leveraging Cognto manage login? My name is Blake Franen. I'm a senior security solutions architect with the Adabus industry's customer acceleration team. And today I want to show you the new integration with Cognto managed login in Adabis W. This exciting new capability released in June 2025 allows you to protect your managed login endpoints from unwanted or malicious requests and web- based attacks. With this integration, you can now define rules that allow or block traffic to Cognto manage login based on your specific business or security requirements. This provides an additional layer of protection and is particularly valuable for organizations that need to obtain strict security standards while providing a seamless authentication experience for legitimate users. Let's discuss the components of this new integration. First, CNO managed login is a fully managed signin and signup experience that you can personalize to align with your company or application branding. and provides a readytouse user interface for authentication operations like signin, signouts, password management, and MFA management. This eliminates the need to build custom authentication interfaces. Manage login also functions as a service provider or relying party to various identity providers including SAL and OIDC based IDs as well as social login providers like Facebook, Amazon, Apple, and Google. It offers advanced features not available in the classic hosted UI such as pass key signin and a visual branding editor that allows you to customize the look and feel to match your brand. It's available in the cognto essentials and plus tiers providing a professional authentication experience that can now be further secured with adabis web is a web application firewall that lets you inspect HTTP and HTTPS requests before they are forwarded to your web application resources. With WT, you can create rules to filter web traffic based on common criteria such as IP addresses, headers, URI strings, or you can block common threats like SQL injection or cross- sight scripting. When integrated with Cognto manage login, W will inspect requests to all manage login endpoints. Based on your configured rules, you can set W to either count, allow, block, or present a capture in response to requests to these endpoints. This integration provides powerful security capabilities including protection against common web exploits and bots based rules to counter DOS attacks and much much more. This integration is available in all eight of regions where Amazon cognto is offered providing you a robust security layer for your authentication infrastructure needs. Now let's see this in action. We have a user pool configured and let's take a look at what manage login looks like. We'll go down to the branding tab and click manage login. And we can see that we have man manage login configuration configured here under styles. We will select this style ID. And here we can preview and make modifications to the branding of our signin or manage login experience. See I have a preconfigured one here that we'll be leveraging for this de demo. Now let's integrate ads w with our user pool. We will go to security and ads w. We can see this is currently inactive. We will click edit. Then use ads w user pool and we'll select user pool here. Purpose of this demo we'll use cognto test and click save changes. W is now integrated with our user pool but we have no rules configured here. Let's go and configure some W rules. We'll move over to the W console and we can see here I have a pre-created rule that we need to modify called capture. We will select that checkbox and click edit. And within here, we want to create a rule that will present a capture challenge to end users. Now, if you choose to use the capture action with manage login, you need to customize that rule to exclude specific headers as this can impact the TOTP or timebased onetime password experience for manage login. Specifically, you need to match against two statements. They're both matching this header field called X Amazon Cognto operation name, but two different strings or values to match here. And we negate these statements. So this means that for all requests that don't match these two header values, we will require a capture action. The first is associate software token. The second is verify software token. Once we have that configured, we can scroll down and flip this from what is currently set to allow to the capture response. We will click save rule. And then we just need to set a rule priority. This is the only rule. So there's no change needed here. And we can click save. This capture response is now active. Let's take a look at what this experience looks like. So we'll go back to the Cognto console. We will select an app client where we currently have the manage login configured. It's under my web app client. We will select login pages. You can see the manage login is available here. We can view the login page. I will copy this link. We'll open a new incognito tab. Visit the site. And we can see we're first prompted before we get to that manage login experience to perform a capture. We will click begin and then complete this capture challenge. Click confirm. We successfully completed that. Now we can log into our application. I have credentials here. We will sign in and then I'm into my application and I can perform whatever actions needed after signing in. You see that's working successfully. Now let's say we want to add a custom rule that will block certain types of traffic. Let's go back to the W console here. We want to add a IP block list. So we'll add our own custom rule. Let's call this IP block. It is a regular rule still and we want to match on a specific statement in this case that originates from an IP address in an IP set that we have defined. this case I have one already defined with my IP for the purposes of the demo matching source IP address and then we will leave the default action of block because we want to block this traffic. Click add rule. We will set the rule priority above just for the purposes of this demo and click save. That IP block is now active. I still have that link copied. So I will open up another tab visit again and we can see we're unable to access that manage login experience now because we have a 403 error. We are blocked from performing that action that is intended as what we want to see. To recap what you saw during this demonstration, we first integrated advis with cognto allowing you to protect cognto manage login endpoints. Then we configured two W rules. First that presented a capture challenge to end users before logging in and then second we blocked specific IP addresses to that application. Now, grab your newest application, integrate with Cognto, attach it to swap to user pool, and protect your Cognto login. Also, take a look at the Cognto documentation and let us know in the comments if you have any questions. Thanks.