Is there a way to lock users if they sign-in too many times in a short period in AWS Cognito?

Question

Can i implement the solution using cloudwatch?

I looked into AWS cloudwatch but I could only set up metrics for logins in general, not per user. Or should i use lambda triggers and RDS to count the user's login attempts?

Answer 1

Cloudwatch as a service can only document your trigger. Like you mentioned, you could count occurences of violation as Metric and subsequently send an event beyond a predetermined threshold.

I have made positive experiences with Lambda triggers. You can easily implement this using the pre- and postAuthentication trigger. There is a related question and answer that sketches the solution:

in Pre-authentication (fired before successful authentication), look up the user (since the user is not authenticated, using adminGetUser, and increment a custom attribute with adminUpdateUserAttributes. If the incremented value is greater than your allowed number of login failures, then disable the user using adminDisableUser. In Post-authentication (fired after successful login), reset the custom attribute to zero.

Note that this might not be necessary if you want to avoid brute force attacks since AWS has built-in protection / rate limiting for the Cognito login endpoints.