41

This is a question about vendor lock in and AWS cognito. Can user data and encrypted/hashed passwords be exported out of cognito if we ever move off of AWS?

Can/does cognito use standard hashing or configurable hashing of the user passwords or allow export of things like tokens?

MonkeyBonkey
  • 46,433
  • 78
  • 254
  • 460

4 Answers4

25

At this point in time, Cognito does not allow a way to export users from a user pool. We have heard this request from other customers, though, and have prioritized it for future releases.

As far as passwords go, Cognito uses secure remote password protocol to do the actual authentications, so the metadata that could come out may not be particularly useful, if it was included at all.

jzonthemtn
  • 3,344
  • 1
  • 21
  • 30
Jeff Bailey
  • 5,655
  • 1
  • 22
  • 30
15

Considering Amazon still haven't updated their answer, here's a workaround (to augment the accepted answer):

Try npmjs.com/package/cognito-backup-restore.

nb. I haven't tested this package.

Then:

  1. Build your replacement auth system
  2. At login, test authenticating with your new system
  3. Try to authenticate with Cognito
  4. If Cognito succeed, import user's details to your new system
  5. Require a password update with your new system

source: forums.aws.amazon.com/thread.jspa?threadID=240242

tgrrr
  • 706
  • 6
  • 16
  • As you mention, this method requires a password reset for every user because as the comment in the NPM library says "Please Note: There is no way of getting passwords of the users in cognito, so you may need to ask them to make use of ForgotPassword to recover their account.". So not a very seamless user experience that might end of losing a bunch of your users. – John Sibly Nov 01 '21 at 16:43
3

This reference architecture might be of some use: https://aws.amazon.com/solutions/implementations/cognito-user-profiles-export-reference-architecture/

It uses the ListUsers API to export user profiles to a DynamoDB table. It is designed to run on a schedule (daily/weekly/etc.) to keep the DynamoDB table up to date with the profiles in the user pool. The source is on GitHub so it be possible to modify the solution to export to a CSV.

If the profiles are imported to a new user pool, user will still need to reset passwords. Other limitations listed in the deployment guide.

supermeng
  • 96
  • 1
  • 1
  • 4
  • Thanks for sharing this -- seems like a lot of resources say you can't get users out of Cognito, but seems like you can. – rpivovar Dec 18 '21 at 15:31
2

Cognito actually has the capability to import users using CSV files, however no export functionality is available ( unless you List Users and write to a CSV )

Avindu Hewa
  • 1,608
  • 1
  • 15
  • 23
  • 5
    Even listing users and building a CSV would still require all users to reset passwords – B M Sep 09 '17 at 17:02
  • The csv import was extremely buggy for us so we ended up opening an EC2 and using CLI to do the import. This allowed setting arbitrary passwords. – Warren Wang Aug 24 '21 at 05:06