Create User Pool

In this section, we will create an Amazon Cognito User Pool to manage user authentication for the FCJ Book Store application.

Amazon Cognito User Pool is a user directory that provides sign-up and sign-in options for your application. It handles user registration, authentication, and account recovery automatically, so you don’t need to build these from scratch.

  1. Open Amazon Cognito console.

    • Select User pools on the left menu.

    • Click Create user pool.

      Cognito User pools - Create user pool

  2. At the Set up resources for your application page.

    • Select Traditional web application as the application type.

    • Choose Traditional web application because our back-end will authenticate users using server-side Lambda functions calling the Cognito API directly (using CLIENT_SECRET), rather than a JavaScript SDK in the browser.

    • Enter cognito-fcaj-book-shop in the Name your application field.

      Set up application - application type and name

    • Scroll down to the Configure options section.

    • Under Sign-in identifier, select Email.

    • Click Create user directory.

      Configure options - Email sign-in and Create user directory

  3. Back to the Amazon Cognito console.

    • Select User pools on the left menu.

    • Choose the User Pool that was just created (e.g., User pool - jbm5in).

      User pools list - newly created pool

  4. At the User Pool details page.

    • Click App clients on the left menu.

    • Click on the cognito-fcaj-book-shop app client name.

      App clients - cognito-fcaj-book-shop

  5. At the App client: cognito-fcaj-book-shop page.

    • Record the Client ID and Client secret values — you will need these in Section 3 when configuring the Lambda functions.

    • The Client secret is only shown once here. If you lose it, you will need to rotate it. Keep it secure and never commit it to source control.

    • Click the Edit button.

      App client - Client ID, Client secret and Edit button

  6. At the Edit app client information page.

    • Under the Authentication flows section, check ALLOW_USER_PASSWORD_AUTH.

    • We enable ALLOW_USER_PASSWORD_AUTH because our Lambda login function calls initiate_auth with AuthFlow="USER_PASSWORD_AUTH" — this flow allows direct username/password authentication. Without this, the API call will return a NotAuthorizedException error.

      Edit app client - enable ALLOW_USER_PASSWORD_AUTH

    • Scroll to the bottom of the page and click Save changes.

      Edit app client - Save changes

We have successfully created the Cognito User Pool and configured the App Client. In the next section, we will create Lambda functions and API Gateway resources to handle user registration, confirmation, and login.