Service to service OAuth2.0 Client Credentials Flow using AWS Cognito and API Gateway

References:
aws.amazon.com/blogs/mobile/u...
oauth.net/2/grant-types/clien...
Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale. APIs act as the "front door" for applications to access data, business logic, or functionality from your backend services. Using API Gateway, you can create RESTful APIs and WebSocket APIs that enable real-time two-way communication applications. API Gateway supports containerized and serverless workloads, as well as web applications.
API Gateway handles all the tasks involved in accepting and processing up to hundreds of thousands of concurrent API calls, including traffic management, CORS support, authorization and access control, throttling, monitoring, and API version management. API Gateway has no minimum fees or startup costs. You pay for the API calls you receive and the amount of data transferred out and, with the API Gateway tiered pricing model, you can reduce your cost as your API usage scales.
Amazon Cognito allows app developers to create their own OAuth2. 0 resource servers and define custom scopes in them. Custom scopes can then be associated with a client, and the client can request them in OAuth2. 0 authorization code grant flow, implicit flow, and client credentials flow.
#AWSAPIGateway #APIGateway #AWSCognito #OAuth2

[@etarasov]

Super helpful, concise and real-world. Was difficult to get this distilled information from the documentation.

[@raaviblog105]

Glad it was helpful!

[@zacharyohare2118]

You got a sub for this one. WHY CAN'T AWS WRITE DECENT DOCS?! It's so convoluted, unless you use CLI, like not everyone wants to be ALL AWS all the time, many are AD federated SSO etc, or we're devs who don't have access to reconfigure our SSO etc, so IDP is great, but they REALLLLLYYY need to make it more staightforward or doc better. THANK YOU for this video.

[@ganeshbabu2002]

Hello Raavi, very good job, straight forward, simple demo, very organized on the content, good explanation

[@raaviblog105]

Thanks Ganesh.

[@Danieltammadge]

Thanks for putting together

[@deepakbhamare2283]

nice explanation and informative

[@ankitapatidar771]

I followed the same to setup the credentials in cognito, don’t have any API gateway. But getting unauthorised while calling the API using the client secret and credential

[@raaviblog105]

How exactly you are testing this? please give more details, can't help with info provided.

[@dharmendrakumarsingh8840]

Hi thanks for a nice explanation, i have follwed video facing one issue i am getting 403 in postmen,and when testing from authorizer it is 401

[@raaviblog105]

Sorry for delayed reply...if it is not resolved yet then please share some more info related to your setup and error you are receiving. Will try to help you.

[@dharmendrakumarsingh8840]

@@raaviblog105 it's resolved now