Easy authen­tic­a­tion on Amazon ECS

Amazon Elastic Con­tainer Ser­vice (Amazon ECS) is a highly scal­able and fast con­tainer man­age­ment ser­vice. We can deploy our con­tain­er­ized applic­a­tions with this ser­vice with options to use either Far­gate or EC2 as launch type, depend­ing on our requirements.

One advant­age of using con­tain­ers is that we can pack all what our applic­a­tion will need inside the con­tainer without affect­ing other applic­a­tions. This will also help us to start a microservice archi­tec­ture, as each con­tainer should have only a single pro­cess run­ning. Just one (small) part of our entire sys­tem, giv­ing us the oppor­tun­ity to scale each microservice inde­pend­ently, sav­ing cost and also provid­ing a high avail­able and fault tol­er­ant sys­tem, by using the fea­ture of Auto Scal­ing which is also integ­rated in ECS. With all this, the developers can focus more on the code of the applic­a­tion and lever­age all this oper­a­tional tasks to AWS.

The simplest deploy­ment for ECS can be like this:

We would have our cluster of ECS behind an Elastic Load Bal­an­cer (ELB), which will be asso­ci­ated to a Route 53 DNS record, so our users can start using our applic­a­tion. One big import­ant point of this simple deploy­ment is that our applic­a­tion is open to any­one over the internet.

We could restrict the access by doing a whitel­ist of IPs in our Secur­ity Group attached to our ELB, but that would only restrict the range of IPs that can access our applic­a­tion, any­one behind those IPs can still access. There­fore, it is a best prac­tice to add a layer of authen­tic­a­tion, and even fur­ther, authorization.

For that our developers could cre­ate a mod­ule in the applic­a­tion that will handle all these steps, but that will take time and effort for the team.

Amazon Cog­nito to the rescue

Thank­fully there is an easier and dir­ect way to do that, by using Amazon Cog­nito, which provides authen­tic­a­tion, author­iz­a­tion, and user man­age­ment for your web and mobile apps. Your users can sign in dir­ectly with a user­name and pass­word, or through a third party such as Face­book, Amazon, Google or Apple.

By using Cog­nito, our deploy­ment would be then like:

This way the request to the ELB can be authen­tic­ated with Cog­nito and the developers don’t have to change any­thing on the code to sup­port this. That would be auto­mat­ic­ally handled by this integ­ra­tion out of the box.

To enable this we would have to use a ELB of type Applic­a­tion Load Bal­an­cer and we will assume Cog­nito has been already configured.

We go to EC2 -> Load bal­an­cers and choose the ELB where we want to enable the authentication:

Then we go to the listener we want to con­fig­ure and click on “Man­age rules”.

Then we edit the rule that is for­ward­ing the traffic to our ECS cluster. We click on “Add Action” -> “Authen­tic­ate”. We should choose at least the Cog­nito user pool and App cli­ent and then click on “Update”.

After that our ELB rules should look like:

And that would be all, from that point onwards every request to our applic­a­tion will ask for our cre­den­tials and our developers didn’t have to change any­thing on the code.

Recap

With these steps we have seen how to enable authen­tic­a­tion eas­ily in our applic­a­tion by using Cog­nito and ELB. On this scen­ario, we are using ECS behind the ELB, but it can be also an Auto Scal­ing Group of EC2, a Lambda func­tion or any­thing com­pat­ible with a Tar­get Group for our ELB.

Please con­sider also that this is only one of many pos­sible scen­arios of hav­ing our applic­a­tion. We could also have API Gate­way in front and integ­rate it with Cog­nito, but for that we will have a look some other time.

I hope this can help you to get famil­iar with the pos­sib­il­it­ies that we have on AWS and thanks for your time for read­ing this post.