Amazon Cognito Introduces Multi-Region Replication for Enhanced Authentication Resilience

Amazon Cognito Multi-Region Replication Launch

Amazon Cognito has launched Multi-Region Replication (MRR), a new feature designed to enhance the resilience and availability of authentication systems. This update allows user pools to be automatically replicated across multiple AWS Regions, providing near-real-time synchronization of user data and configurations.

The introduction of MRR addresses the complexity traditionally associated with building multi-Region authentication, which often required custom replication solutions. This new capability aims to reduce operational overhead for businesses that need to ensure continuous authentication availability across different geographies.

How Multi-Region Replication Works

Amazon Cognito MRR creates a replica user pool in a secondary AWS Region that shares the same user pool ID as the primary user pool. The primary user pool, located in the primary Region, remains the authoritative source for all write operations, including user data updates, configuration changes, and external identity provider settings.

Configurations such as app client IDs, client secrets, user attributes, hashed credentials, and group memberships are replicated to the replica Region with eventual consistency. This ensures that user data is available in multiple locations, supporting disaster recovery and high availability scenarios.

Supported Operations in Replica Regions

Replica user pools in secondary Regions support user authentication operations, including sign-in, token generation, and token revocation. They also allow read-only operations on user pool configurations and user attributes, such as listing users and groups or describing user pool configurations.

Write operations against user pool configurations and updates to user attributes are not enabled in replica user pools. Attempts to perform these operations in a replica Region will result in an 'Action temporarily unavailable' error for managed logins or an 'OperationNotEnabledException' when using an AWS SDK.

Interoperability and Use Cases

JSON web tokens (JWTs) and active sessions are interoperable between Regions, meaning a refresh token issued in one Region can be used in another. This facilitates seamless user experiences during failover events or when users access applications from different geographical locations.

The new MRR feature is applicable for various use cases, including business-to-consumer (B2C), business-to-business (B2B), and machine-to-machine (M2M) authentication, providing a robust foundation for customer identity and access management systems.