c3.6 Secure customer identity
Do not hand-build authentication — home-grown login pages are prone to SQL injection and broken-authentication flaws. Use a managed identity service like Amazon Cognito for customer sign-in, and add AWS WAF account-takeover protection on the login endpoint.
Implementation guidance
Use a managed customer identity service
Custom authentication code is a frequent source of vulnerabilities — SQL injection against user tables and other broken-authentication flaws. Use Amazon Cognito for customer (CIAM) sign-in: it provides secure, standards-based authentication (SAML, OpenID Connect, OAuth 2.0), optional MFA, single sign-on, and social federation. Partner identity providers such as Okta, Auth0, and Ping Identity are also available on the AWS Marketplace.
Defend the login endpoint
Add AWS WAF Fraud Control – Account Takeover Prevention (ATP) to intercept malicious sign-in behavior such as credential stuffing with breached credentials and password-guessing.
How it fits together
How to validate
- Are you using a managed identity service (such as Amazon Cognito) rather than custom authentication code?
- Is MFA available to your customers?
- Have you added account-takeover protection (AWS WAF ATP or similar) on the login endpoint?
Threats addressed
- Home-grown authentication pages are a common target for SQL injection and broken-authentication attacks that can expose or bypass customer credentials.
- Credential stuffing and password-guessing against the login endpoint can take over customer accounts if not actively blocked.
AWS services
Amazon Cognito 
AWS WAF Pricing
Amazon Cognito is priced per monthly active user (MAU) across its Lite, Essentials, and Plus plans; the Essentials tier (default for new user pools) includes 10,000 free MAUs. See Cognito pricing. AWS WAF ATP has a monthly fee plus a charge per thousand login attempts analyzed — see AWS WAF pricing.