Authentication mechanism

Innovation Sandbox on AWS authenticates web UI users with Amazon Cognito, which federates to the Single Sign-On service from AWS IAM Identity Center using the SAML 2.0 protocol. You register a SAML 2.0 application in IAM Identity Center and provide its metadata URL to the solution; Amazon Cognito acts as the SAML service provider.

When a user signs in, Amazon Cognito completes the SAML flow with IAM Identity Center and issues an ID token. A Cognito Pre Token Generation trigger resolves your IAM Identity Center group memberships and adds the corresponding solution roles (Admin, Manager, or User) to the token. A Cognito identity pool then exchanges the ID token for temporary IAM credentials mapped to one of three role tiers.

The web UI signs every API request with those temporary credentials using AWS Signature Version 4 (SigV4). It also includes the Cognito ID token in a signed x-isb-identity header. API Gateway authorizes requests natively using IAM authorization and does not require a custom Lambda authorizer. Handler-side middleware verifies the x-isb-identity token and enforces role-based access control.

The solution API can also be called programmatically; see Programmatic access (machine-to-machine).

You sign in to sandbox accounts from the Applications tab on the AWS access portal.