How to add MFA to AWS Cognito using AWS SDK and Authsignal

This project demonstrates how to integrate AWS Cognito with Authsignal's MFA capabilities for secure authentication.

Overview

The integration uses:

• AWS Cognito as the identity provider
• Authsignal for MFA verification
• AWS Lambda triggers to connect the services
• React frontend for user interaction

Features

• MFA for both sign-up and sign-in flows
• Multiple authentication methods:
  • Email OTP
  • Email Magic Links
  • TOTP (Authenticator Apps)
  • Passkeys (WebAuthn)

Setup Instructions

Prerequisites

• Node.js
• AWS Account
• Authsignal Account

Environment Variables

1. Create a .env file in the root directory:

AUTHSIGNAL_SECRET=your_authsignal_secret_key
AUTHSIGNAL_URL=https://api.authsignal.com
USER_POOL_CLIENT_ID=your_cognito_user_pool_client_id
AWS_REGION=your_aws_region

2. Create a .env file in the lambdas directory:

AUTHSIGNAL_SECRET=your_authsignal_secret_key
AUTHSIGNAL_URL=https://api.authsignal.com
USER_POOL_CLIENT_ID=your_cognito_user_pool_client_id

Installation

1. Install dependencies:

yarn install

2. Install Lambda dependencies:

cd lambdas
yarn install
cd ..

Running the Project

1. Start the frontend development server:

yarn dev

2. Deploy Lambda functions to AWS:

cd lambdas
yarn deploy

Implementation Details

Backend Components

The integration uses Lambda functions for authentication flow:

1. Pre-Sign-Up Lambda: Auto-confirms users during registration
2. Create Auth Challenge: Generates Authsignal tokens for verification
3. Verify Auth Challenge Response: Validates user responses

Frontend Flows

• Sign-Up: Collects email, creates user account, and verifies identity
• Sign-In: Authenticates returning users with MFA
• Account Management: Allows users to add/remove authenticators

Authentication Methods

Users can authenticate with:

1. Email OTP: Codes sent via email
2. Email Magic Links: One-click verification links
3. TOTP: Time-based codes from authenticator apps
4. Passkeys: Biometric and device-based authentication

Conclusion

This implementation provides a secure, flexible authentication system that balances security with user experience. The AWS SDK and Authsignal integration gives full control over authentication flows and UI design.