techlist.io
KREN
aws

Improve your application resilience with Amazon Cognito multi-Region replication | Amazon Web Services (opens in new tab)

aws-lambdaoauthsamlopenid-connectamazon-cognitoaws-kmsamazon-route-53multi-region-replication

Amazon Cognito multi-Region replication improves authentication resilience by maintaining synchronized user data, credentials, configurations, and machine secrets in a secondary AWS Region. During a regional outage, applications can redirect traffic while users continue using existing credentials and sessions, though registration and profile updates are unavailable during failover. The feature also adds customer managed AWS KMS keys for consistent, customer-controlled encryption across Regions.

Challenges with Regional Failover

  • Custom replication solutions previously required significant engineering effort.
  • Manual user-data transfers introduced security and consistency risks.
  • Users could be forced to reset passwords or authenticate again after a regional switch.
  • Machine-to-machine systems required new app clients, application reconfiguration, and updated OAuth resource trust settings.

How Multi-Region Replication Works

  • Replication is one-way, from a primary Region to a secondary Region.
  • The replica includes:
    • User profiles and credentials
    • User pool configuration
    • Machine-to-machine secrets
  • The secondary pool is read-only and remains available for authentication.
  • Existing sessions continue uninterrupted.
  • Users can authenticate with existing credentials, and either Region recognizes access tokens issued by the other.
  • Supported authentication methods include:
    • Social identity providers
    • SAML and OIDC federation
    • API authorization flows
    • Machine-to-machine authentication
  • New registrations and profile changes are unavailable while operating from the replica.

Customer Managed KMS Keys

  • A multi-Region customer managed key is required before replication can be configured.
  • The key must be replicated into both the primary and secondary Regions.
  • Its policy must grant Amazon Cognito permission to use the key.
  • Customer managed keys provide consistent encryption across Regions and greater control over encryption policies.

Configuration Process

  • The console guides administrators through three main steps:
    • Select and configure the customer managed KMS key.
    • Configure multi-Region OIDC issuer endpoints.
    • Select and create the replica Region.
  • Client applications must be updated with the new OIDC endpoints.
  • Server-side applications require redeployment, while mobile applications require updated store submissions.
  • After the replica is prepared, an administrator must manually activate it.

Additional Regional Resources

  • Lambda functions used for custom authentication, SMS, or email must be deployed and configured in the secondary Region.
  • Logging and AWS WAF settings must also be recreated there.
  • Teams should verify that all supporting authentication infrastructure is available before failover.

Health Checks and Failover

  • Both regional endpoints remain active and ready to serve traffic.
  • Applications should define health checks based on error rates, latency, or service alerts.
  • DNS can redirect traffic to the secondary Region when failover criteria are met.
  • Teams should test failover during low-traffic periods, potentially routing only a small percentage of traffic initially.
  • Managed login and federation with custom domains can use Amazon Route 53 health checks for built-in traffic routing.

Pricing and Availability

  • Replication is available as an add-on for Cognito Essentials and Plus tiers.
  • User authentication costs:
    • $0.0045 per monthly active user per replica Region for Essentials
    • $0.006 per monthly active user per replica Region for Plus
  • M2M replication adds 30% to standard successful-token pricing.
  • The feature is available across selected Regions in North America, Europe, Asia Pacific, Canada, Africa, and South America.

Organizations needing resilient authentication should pair Cognito replication with multi-Region KMS keys, replicated supporting services, tested health checks, and an automated or well-practiced DNS failover process.