Amazon Cognito身份服务

接入教程

1. 在AWS控制台创建身份池
2. 配置身份提供商（如Facebook、Google）
3. 集成SDK到移动应用
4. 调用获取凭证API
5. 使用凭证访问AWS服务
6. 同步用户身份状态

使用Python获取临时凭证

python

import boto3

# Initialize Cognito Identity client
client = boto3.client('cognito-identity', region_name='us-east-1')

# Get ID for an identity pool
try:
    response = client.get_id(
        IdentityPoolId='us-east-1:example-pool-id',
        AccountId='123456789012'
    )
    identity_id = response['IdentityId']
    print(f'Identity ID: {identity_id}')

    # Get credentials for the identity
    cred_response = client.get_credentials_for_identity(
        IdentityId=identity_id
    )
    credentials = cred_response['Credentials']
    print(f'Access Key: {credentials["AccessKeyId"]}')
    print(f'Secret Key: {credentials["SecretKey"]}')
    print(f'Session Token: {credentials["SessionToken"]}')
except Exception as e:
    print(f'Error: {e}')

使用PHP通过身份池获取凭证

php

<?php
require 'vendor/autoload.php';

use Aws\CognitoIdentity\CognitoIdentityClient;
use Aws\Exception\AwsException;

$client = new CognitoIdentityClient([
    'region' => 'us-east-1',
    'version' => 'latest'
]);

try {
    // Obtain an identity ID
    $result = $client->getId([
        'IdentityPoolId' => 'us-east-1:example-pool-id',
        'AccountId' => '123456789012'
    ]);
    $identityId = $result['IdentityId'];
    echo 'Identity ID: ' . $identityId . PHP_EOL;

    // Get credentials for the identity
    $credResult = $client->getCredentialsForIdentity([
        'IdentityId' => $identityId
    ]);
    $credentials = $credResult['Credentials'];
    echo 'Access Key: ' . $credentials['AccessKeyId'] . PHP_EOL;
    echo 'Secret Key: ' . $credentials['SecretKey'] . PHP_EOL;
    echo 'Session Token: ' . $credentials['SessionToken'] . PHP_EOL;
} catch (AwsException $e) {
    echo 'Error: ' . $e->getMessage() . PHP_EOL;
}
?>

使用JavaScript获取联合身份凭证

javascript

const AWS = require('aws-sdk');

// Configure AWS SDK
AWS.config.update({ region: 'us-east-1' });

const cognitoIdentity = new AWS.CognitoIdentity();

async function getCredentials() {
    try {
        // Get identity ID
        const getIdParams = {
            IdentityPoolId: 'us-east-1:example-pool-id',
            AccountId: '123456789012'
        };
        const idResponse = await cognitoIdentity.getId(getIdParams).promise();
        const identityId = idResponse.IdentityId;
        console.log(`Identity ID: ${identityId}`);

        // Retrieve credentials
        const credParams = {
            IdentityId: identityId
        };
        const credResponse = await cognitoIdentity.getCredentialsForIdentity(credParams).promise();
        const credentials = credResponse.Credentials;
        console.log(`Access Key: ${credentials.AccessKeyId}`);
        console.log(`Secret Key: ${credentials.SecretKey}`);
        console.log(`Session Token: ${credentials.SessionToken}`);
    } catch (error) {
        console.error(`Error: ${error.message}`);
    }
}

getCredentials();

常见问题

Amazon Cognito联合身份的主要用途是什么？

Amazon Cognito联合身份服务主要为移动应用、Web应用等非受信环境提供临时的、有作用域的AWS凭证。它允许用户通过社交身份提供商（如Google、Facebook）或自定义身份系统登录，并获取访问AWS资源的临时安全凭证，无需在客户端存储长期密钥。

身份池和用户池有什么区别？

身份池用于授权，负责为用户提供临时AWS凭证以访问AWS服务；用户池用于身份验证，是一个用户目录，处理用户注册、登录和账户管理。两者可结合使用：用户池验证用户后，身份池为其提供访问AWS资源的凭证。

临时凭证的有效期是多久？

默认情况下，Amazon Cognito联合身份颁发的临时凭证有效期为1小时。可通过设置角色会话持续时间进行配置，但最长不超过12小时（使用IAM角色）或1小时（使用Web身份联合）。过期后需刷新或重新获取新凭证。