Security - Serverless Bot Framework

Security

When you build systems on AWS infrastructure, security responsibilities are shared between you and AWS. This shared model can reduce your operational burden as AWS operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the services operate. For more information about security on AWS, visit the AWS Security Center.

Amazon Cognito identity pools

This solution leverages Amazon Cognito to authenticate user’s credentials. Then, it provides a temporary token which will be used by the client to authorize API calls to Amazon API Gateway. The client’s device will request the sample web application through Amazon CloudFront then the downloaded web application on the client’s device will communicate to API Gateway.

For information on protecting your resources, refer to Controlling and Managing Access to a REST API in API Gateway in the Amazon API Gateway Developer Guide and Identity and Access Management in Amazon S3 in the Amazon Simple Storage Service Developer Guide.