Understanding Amazon Cognito sign-in events - Amazon Cognito

Understanding Amazon Cognito sign-in events

A trail can deliver events as log files to an Amazon S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files are not an ordered stack trace of the public API calls, so they do not appear in any specific order.

Example CloudTrail event for CreateIdentityPool

The following example is a log entry for a request for the CreateIdentityPool action. The request was made by an IAM user named Alice.

{ "eventVersion": "1.03", "userIdentity": { "type": "IAMUser", "principalId": "PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:user/Alice", "accountId": "123456789012", "accessKeyId": "['EXAMPLE_KEY_ID']", "userName": "Alice" }, "eventTime": "2016-01-07T02:04:30Z", "eventSource": "cognito-identity.amazonaws.com", "eventName": "CreateIdentityPool", "awsRegion": "us-east-1", "sourceIPAddress": "127.0.0.1", "userAgent": "USER_AGENT", "requestParameters": { "identityPoolName": "TestPool", "allowUnauthenticatedIdentities": true, "supportedLoginProviders": { "graph.facebook.com": "000000000000000" } }, "responseElements": { "identityPoolName": "TestPool", "identityPoolId": "us-east-1:1cf667a2-49a6-454b-9e45-23199EXAMPLE", "allowUnauthenticatedIdentities": true, "supportedLoginProviders": { "graph.facebook.com": "000000000000000" } }, "requestID": "15cc73a1-0780-460c-91e8-e12ef034e116", "eventID": "f1d47f93-c708-495b-bff1-cb935a6064b2", "eventType": "AwsApiCall", "recipientAccountId": "123456789012" }

Example CloudTrail events for a hosted UI sign-up

The following example CloudTrail events demonstrate the information that Amazon Cognito logs when a user signs up through the hosted UI.

Amazon Cognito logs the following event when a new user navigates to the sign-in page for your app.

{ "eventVersion": "1.08", "userIdentity": { "accountId": "123456789012" }, "eventTime": "2022-04-06T05:38:12Z", "eventSource": "cognito-idp.amazonaws.com", "eventName": "Login_GET", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...", "errorCode": "", "errorMessage": "", "additionalEventData": { "responseParameters": { "status": 200.0 }, "requestParameters": { "redirect_uri": [ "https://www.amazon.com" ], "response_type": [ "token" ], "client_id": [ "1example23456789" ] } }, "eventID": "382ae09a-151d-4116-8f2b-6ac0a804a38c", "readOnly": true, "eventType": "AwsServiceEvent", "managementEvent": true, "recipientAccountId": "123456789012", "serviceEventDetails": { "serviceAccountId": "111122223333" }, "eventCategory": "Management" }

Amazon Cognito logs the following event when a new user chooses Sign up from the sign-in page for your app.

{ "eventVersion": "1.08", "userIdentity": { "accountId": "123456789012" }, "eventTime": "2022-05-05T23:21:43Z", "eventSource": "cognito-idp.amazonaws.com", "eventName": "Signup_GET", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...", "requestParameters": null, "responseElements": null, "additionalEventData": { "responseParameters": { "status": 200 }, "requestParameters": { "response_type": [ "code" ], "redirect_uri": [ "https://www.amazon.com" ], "client_id": [ "1example23456789" ] }, "userPoolDomain": "mydomain.us-west-2.amazoncognito.com", "userPoolId": "us-west-2_aaaaaaaaa" }, "requestID": "7a63e7c2-b057-4f3d-a171-9d9113264fff", "eventID": "5e7b27a0-6870-4226-adb4-f86cd51ac5d8", "readOnly": true, "eventType": "AwsServiceEvent", "managementEvent": true, "recipientAccountId": "123456789012", "serviceEventDetails": { "serviceAccountId": "111122223333" }, "eventCategory": "Management" }

Amazon Cognito logs the following event when a new user chooses a user name, enters an email address, and chooses a password from the sign-in page for your app. Amazon Cognito doesn't log identifying information about the user's identity to CloudTrail.

{ "eventVersion": "1.08", "userIdentity": { "accountId": "123456789012" }, "eventTime": "2022-05-05T23:22:05Z", "eventSource": "cognito-idp.amazonaws.com", "eventName": "Signup_POST", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...", "requestParameters": null, "responseElements": null, "additionalEventData": { "responseParameters": { "status": 302 }, "requestParameters": { "password": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ], "requiredAttributes[email]": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ], "response_type": [ "code" ], "_csrf": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ], "redirect_uri": [ "https://www.amazon.com" ], "client_id": [ "1example23456789" ], "username": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ] }, "userPoolDomain": "mydomain.us-west-2.amazoncognito.com", "userPoolId": "us-west-2_aaaaaaaaa" }, "requestID": "9ad58dd8-3517-4aa8-96a5-d17a01df9eb4", "eventID": "c75eb7a5-eb8c-43d1-8331-f4412e756e69", "readOnly": false, "eventType": "AwsServiceEvent", "managementEvent": true, "recipientAccountId": "123456789012", "serviceEventDetails": { "serviceAccountId": "111122223333" }, "eventCategory": "Management" }

Amazon Cognito logs the following event when a new user accesses the user confirmation page in the hosted UI after they sign up.

{ "eventVersion": "1.08", "userIdentity": { "accountId": "123456789012" }, "eventTime": "2022-05-05T23:22:06Z", "eventSource": "cognito-idp.amazonaws.com", "eventName": "Confirm_GET", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...", "requestParameters": null, "responseElements": null, "additionalEventData": { "responseParameters": { "status": 200 }, "requestParameters": { "response_type": [ "code" ], "redirect_uri": [ "https://www.amazon.com" ], "client_id": [ "1example23456789" ] }, "userPoolDomain": "mydomain.us-west-2.amazoncognito.com", "userPoolId": "us-west-2_aaaaaaaaa" }, "requestID": "58a5b170-3127-45bb-88cc-3e652d779e0b", "eventID": "7f87291a-6d50-409a-822f-e3a5ec7e60da", "readOnly": false, "eventType": "AwsServiceEvent", "managementEvent": true, "recipientAccountId": "123456789012", "serviceEventDetails": { "serviceAccountId": "111122223333" }, "eventCategory": "Management" }

Amazon Cognito logs the following event when, in the user confirmation page in the hosted UI, a user enters a code that Amazon Cognito sent them in an email message.

{ "eventVersion": "1.08", "userIdentity": { "accountId": "123456789012" }, "eventTime": "2022-05-05T23:23:32Z", "eventSource": "cognito-idp.amazonaws.com", "eventName": "Confirm_POST", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...", "requestParameters": null, "responseElements": null, "additionalEventData": { "responseParameters": { "status": 302 }, "requestParameters": { "confirm": [ "" ], "deliveryMedium": [ "EMAIL" ], "sub": [ "704b1e47-34fe-40e9-8c41-504997494531" ], "code": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ], "destination": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ], "response_type": [ "code" ], "_csrf": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ], "cognitoAsfData": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ], "redirect_uri": [ "https://www.amazon.com" ], "client_id": [ "1example23456789" ], "username": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ] }, "userPoolDomain": "mydomain.us-west-2.amazoncognito.com", "userPoolId": "us-west-2_aaaaaaaaa" }, "requestID": "9764300a-ed35-4f87-8a0f-b18b3fe2b11e", "eventID": "e24ac6e5-2f70-4c6e-ad4e-2f08a547bb36", "readOnly": false, "eventType": "AwsServiceEvent", "managementEvent": true, "recipientAccountId": "123456789012", "serviceEventDetails": { "serviceAccountId": "111122223333" }, "eventCategory": "Management" }

Example CloudTrail event for a SAML request

Amazon Cognito logs the following event when a user who has authenticated with your SAML IdP submits the SAML assertion to your /saml2/idpresponse endpoint.

{ "eventVersion": "1.08", "userIdentity": { "accountId": "123456789012" }, "eventTime": "2022-05-06T00:50:57Z", "eventSource": "cognito-idp.amazonaws.com", "eventName": "SAML2Response_POST", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...", "requestParameters": null, "responseElements": null, "additionalEventData": { "responseParameters": { "status": 302 }, "requestParameters": { "RelayState": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ], "SAMLResponse": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ] }, "userPoolDomain": "mydomain.us-west-2.amazoncognito.com", "userPoolId": "us-west-2_aaaaaaaaa" }, "requestID": "4f6f15d1-c370-4a57-87f0-aac4817803f7", "eventID": "9824b50f-d9d1-4fb8-a2c1-6aa78ca5902a", "readOnly": false, "eventType": "AwsServiceEvent", "managementEvent": true, "recipientAccountId": "625647942648", "serviceEventDetails": { "serviceAccountId": "111122223333" }, "eventCategory": "Management" }

Example CloudTrail events for requests to the token endpoint

The following are example events from requests to the Token endpoint.

Amazon Cognito logs the following event when a user who has authenticated and received an authorization code submits the code to your /oauth2/token endpoint.

{ "eventVersion": "1.08", "userIdentity": { "accountId": "123456789012" }, "eventTime": "2022-05-12T22:12:30Z", "eventSource": "cognito-idp.amazonaws.com", "eventName": "Token_POST", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...", "requestParameters": null, "responseElements": null, "additionalEventData": { "responseParameters": { "status": 200 }, "requestParameters": { "code": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ], "grant_type": [ "authorization_code" ], "redirect_uri": [ "https://www.amazon.com" ], "client_id": [ "1example23456789" ] }, "userPoolDomain": "mydomain.us-west-2.amazoncognito.com", "userPoolId": "us-west-2_aaaaaaaaa" }, "requestID": "f257f752-cc14-4c52-ad5b-152a46915238", "eventID": "0bd1586d-cd3e-4d7a-abaf-fd8bfc3912fd", "readOnly": false, "eventType": "AwsServiceEvent", "managementEvent": true, "recipientAccountId": "123456789012", "serviceEventDetails": { "serviceAccountId": "111122223333" }, "eventCategory": "Management" }

Amazon Cognito logs the following event when your back-end system submits a client_credentials request for an access token to your /oauth2/token endpoint.

{ "eventVersion": "1.08", "userIdentity": { "accountId": "123456789012" }, "eventTime": "2022-05-12T21:07:05Z", "eventSource": "cognito-idp.amazonaws.com", "eventName": "Token_POST", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...", "requestParameters": null, "responseElements": null, "additionalEventData": { "responseParameters": { "status": 200 }, "requestParameters": { "grant_type": [ "client_credentials" ], "client_id": [ "1example23456789" ] }, "userPoolDomain": "mydomain.us-west-2.amazoncognito.com", "userPoolId": "us-west-2_aaaaaaaaa" }, "requestID": "4f871256-6825-488a-871b-c2d9f55caff2", "eventID": "473e5cbc-a5b3-4578-9ad6-3dfdcb8a6d34", "readOnly": false, "eventType": "AwsServiceEvent", "managementEvent": true, "recipientAccountId": "123456789012", "serviceEventDetails": { "serviceAccountId": "111122223333" }, "eventCategory": "Management" }

Amazon Cognito logs the following event when your app exchanges a refresh token for a new ID and access token with your /oauth2/token endpoint.

{ "eventVersion": "1.08", "userIdentity": { "accountId": "123456789012" }, "eventTime": "2022-05-12T22:16:40Z", "eventSource": "cognito-idp.amazonaws.com", "eventName": "Token_POST", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.1", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...", "requestParameters": null, "responseElements": null, "additionalEventData": { "responseParameters": { "status": 200 }, "requestParameters": { "refresh_token": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ], "grant_type": [ "refresh_token" ], "client_id": [ "1example23456789" ] }, "userPoolDomain": "mydomain.us-west-2.amazoncognito.com", "userPoolId": "us-west-2_aaaaaaaaa" }, "requestID": "2829f0c6-a3a9-4584-b046-11756dfe8a81", "eventID": "12bd3464-59c7-44fa-b8ff-67e1cf092018", "readOnly": false, "eventType": "AwsServiceEvent", "managementEvent": true, "recipientAccountId": "123456789012", "serviceEventDetails": { "serviceAccountId": "111122223333" }, "eventCategory": "Management" }