AWS Cognito

The displayed Metrics of AWS Cognito include the number of user pools, the number of user login requests, the number of user registrations, the number of restricted user login requests, the number of token refreshes, etc.

Configuration¶

Install Func¶

It is recommended to enable Guance Integration - Extension - DataFlux Func (Automata): All prerequisites are automatically installed. Please continue with the script installation.

If you deploy Func on your own, refer to Self-deployed Func

Installation Script¶

Note: Please prepare the required Amazon AK in advance (for simplicity, you can directly grant global read-only permission ReadOnlyAccess)

Managed Version Activation Script¶

1. Log in to the Guance console.
2. Click on the 【Integration】 menu and select 【Cloud Account Management】.
3. Click 【Add Cloud Account】, select 【AWS】, and fill in the required information on the interface; if cloud account information has been configured before, ignore this step.
4. Click 【Test】. After a successful test, click 【Save】. If the test fails, check whether the relevant configuration information is correct and retest.
5. In the 【Cloud Account Management】 list, you can see the added cloud account. Click the corresponding cloud account to enter the details page.
6. Click the 【Integration】 button on the cloud account details page. In the Not Installed list, find AWS Cognito, click the 【Install】 button, and install it from the pop-up installation interface.

Manual Activation Script¶

1. Log in to the Func console, click 【Script Market】, enter the official script market, and search for guance_aws_cognito.

2. After clicking 【Install】, input the corresponding parameters: AWS AK ID, AK Secret, and account name.

3. Click 【Deploy Startup Script】, and the system will automatically create a Startup script set and configure the corresponding startup script automatically.

4. After enabling, you can see the corresponding automatic trigger configuration in 「Manage / Automatic Trigger Configuration」. Click 【Execute】 to run it immediately without waiting for the scheduled time. After a short wait, you can view the execution task records and corresponding logs.

We default to collecting some configurations, see the Metrics section for details.

Verification¶

1. Confirm in 「Manage / Automatic Trigger Configuration」 that the corresponding tasks have corresponding automatic trigger configurations, and at the same time, you can check the corresponding task records and logs to ensure there are no abnormalities.
2. In Guance, under 「Infrastructure / Custom」, check if asset information exists.
3. In Guance, under 「Metrics」, check if there are corresponding monitoring data.

Metrics¶

After configuring Amazon-CloudWatch, the default Measurement set is as follows. You can collect more Metrics through configuration:

Amazon CloudWatch AWS Cognito Metrics Details

View Threat Protection Metrics¶