Enhancing Security with Amazon Cognito: Using Email as a Multi-Factor Authentication (MFA) Option

Why Use Email for MFA?

SMS is often used for MFA, but it’s not always ideal:

• SMS costs can accumulate for businesses with large user bases.
• Network issues may prevent users from receiving SMS codes.
• Users may feel uncomfortable sharing their phone numbers.

Email-based MFA is a great alternative that leverages a user’s email address for sending one-time passcodes (OTP). It’s cost-effective, accessible, and user-friendly, as most users already have access to their email across devices.

Setting Up Email-Based MFA in Amazon Cognito

Step 1: Access Amazon Cognito

1. Log in to AWS Management Console.
2. Navigate to the Amazon Cognito service.
3. Click on User Pools in the left-hand menu.
4. In the top-right corner, click Create a user pool to start the setup process.

Step 2: Configure Sign-In Experience

1. In the Configure sign-in experience section, select Cognito user pool as the authentication provider.
2. For Sign-in options, choose Username and deselect any additional username requirements unless needed.
3. Click Next.

Step 3: Configure Security Requirements

1. In the Password policy section, use Cognito defaults for password strength or customize as per your preference.
2. Under Multi-factor authentication (MFA), for MFA enforcement, choose Optional MFA (or Required MFA if you want all users to use MFA).
3. Under MFA methods, select Email message to enable email-based MFA.
4. For User account recovery, select Email only as the delivery method for recovery messages.
5. Click Next to proceed.

Step 4: Configure Sign-Up Experience

1. Ensure that enable self-registration is selected if you want to allow users to sign themselves up.
2. Under Cognito-assisted verification and confirmation, ensure Send email message, verify email address is selected for identity verification.
3. In Attributes to verify, confirm that Email is the chosen method.
4. Under Required attributes, make sure that only Email is selected.
5. Ensure Phone number is not selected as a required attribute since we’re using email for MFA.
6. Click Next to continue.

Step 5: Configure Message Delivery

1. In the Configure message delivery section, choose Send email with Cognito for testing purposes. This uses Cognito’s default email sender.
2. Optionally, set up Amazon SES for better email delivery control.
3. If SMS is required for other scenarios, create a new IAM role to allow Cognito to send SMS messages.
4. Click Next.

Step 6: Integrate Your App

1. Under User pool name, enter a unique name for your pool.
2. Do not select the Cognito hosted UI unless you’re using Cognito’s built-in UI.
3. For App client settings, ensure that App type is set to public client.
4. Do not generate a client secret unless needed for certain secure apps.
5. Enter a name for your App client.
6. Under Advanced app client settings, add ALLOW_USER_PASSWORD_AUTH to the authentication flow.
7. Click Next.

Step 7: Review and Create

1. Review all your settings on the Review and create page.
2. Make any necessary adjustments.
3. Once everything is confirmed, click Create user pool.

Step 8: Set Up MFA in the User Pool

1. After creating your user pool, navigate to the User pool overview.
2. Click on the Sign-in experience tab.
3. Under multi-factor authentication (MFA), click Edit.
4. Ensure Optional MFA (or Required MFA) is selected and confirm that Email message is checked under MFA methods.
5. Click Save changes.

Step 9: Configure App Client (Client ID)

1. In the App integration tab of your user pool, locate the App clients and analytics section.
2. Select your app client, and note down the Client ID. This will be required for application integration.

Step 10: Testing MFA

1. Create a test user in your Cognito user pool.
2. Sign in with the test user, and check for the email containing the OTP (one-time passcode) for MFA.
3. Enter the OTP to complete the login process and verify that the email MFA setup is functioning correctly.

Lambda Trigger for MFA Customization

• You may need to set up an AWS Lambda function to trigger email-based MFA under custom conditions. For example, if you only want email MFA for users in certain regions or after a number of failed login attempts.
• Use the Pre-Signup or Pre-Authentication Lambda triggers to inject custom logic for sending OTPs.

Benefits of Using Amazon Cognito Email-Based MFA

1. Cost-Effective: No SMS charges make this ideal for applications with a large user base.
2. Convenient: Email is widely accessible, and users are generally more comfortable sharing their email addresses than their phone numbers.
3. Scalable: Amazon Cognito handles the scaling and infrastructure for sending verification emails.
4. Security: By adding email-based MFA, you protect users from password theft and unauthorized access, greatly reducing the risk of account compromise.

Conclusion

Incorporating email as an MFA option with Amazon Cognito is an easy-to-implement solution that improves security without sacrificing user convenience. Whether you’re looking to provide more options to your users or avoid the complexities of SMS-based MFA, this method provides a robust security solution.

By following the steps outlined above, you can quickly set up and roll out email-based MFA in your Amazon Cognito user pool, securing your application while ensuring a seamless user experience.