# Tutorial: Using Cerbos with AWS Cognito

|     |     |
| --- | --- |
|  | This documentation is for<br>an as-yet unreleased<br>version of Cerbos PDP. Choose 0.53.0 from the version picker at the top right or navigate to [https://docs.cerbos.dev](https://docs.cerbos.dev/) for the latest version. |

An example application of integrating [Cerbos](/content/site-root.html) with a [FastAPI](https://fastapi.tiangolo.com/) server using [AWS Cognito](https://aws.amazon.com/cognito/) for authentication.

Using Cerbos with AWS Cognito - YouTube

Tap to unmute

[Using Cerbos with AWS Cognito](https://www.youtube.com/watch?v=bRknI_B0hcs) [Cerbos](https://www.youtube.com/channel/UCSfAKV6Tkv2AHqNNknvXYPg)

Cerbos420 subscribers

## Dependencies

- Python 3.10

- Docker for running the [Cerbos Policy Decision Point (PDP)](https://docs.cerbos.dev/cerbos/latest/installation/container)

- A configured AWS Cognito User Pool ( [set-up guide](https://docs.aws.amazon.com/cognito/latest/developerguide/getting-started-with-cognito-user-pools.html))

## Getting started

1. Clone the repo

```bash
   git clone git@github.com:cerbos/python-cognito-cerbos.git
   ```

```bash
   cd cerbos
   ./start.sh
   ```

```bash
   # from project root
   ./pw install
   ```

```bash
   AWS_COGNITO_POOL_ID
   AWS_COGNITO_CLIENT_ID
   AWS_DEFAULT_REGION
   AWS_COGNITO_POOL_NAME

# if you've configured your user pool with a client secret
   AWS_COGNITO_CLIENT_SECRET

# optionally, to enable the hosted UI:
   AWS_COGNITO_HOSTED_UI_CALLBACK_URL # this needs to match the callback URL configured for the hosted UI
   AWS_COGNITO_HOSTED_UI_LOGOUT_URL
   ```

```bash
   ./pw demo
   ```

## Cognito Configuration

### Groups

This demo maps Cognito User Pool groups to Cerbos roles. The app will retrieve the groups from the access token, and use them to determine authorization.

Any test users in your pool should be added to one or both of `admin` and/or `user` groups to demonstrate different access to the demo resources.

## Policies

This example has a simple CRUD policy in place for a resource kind of `contact` \- like a CRM system would have. The policy file can be found in the `cerbos/policies` folder [here](https://github.com/cerbos/python-cognito-cerbos/blob/main/cerbos/policies/contact.yaml).

Should you wish to experiment with this policy, you can try it in the [Cerbos Playground](https://play.cerbos.dev/p/g561543292ospj7w0zOrFx7H5DzhmLu2).

The policy expects one of two roles to be set on the principal - `admin` and `user`. These roles are authorized as follows:

| Action | User | Admin |
| --- | --- | --- |
| list | Y | Y |
| read | Y | Y |
| create | Y | Y |
| update | If owner | Y |
| delete | If owner | Y |

This business logic is represented in Cerbos as a resource policy.

```yaml
---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: contact
  rules:
    - actions: ["read", "create"]
      effect: EFFECT_ALLOW
      roles:
        - admin
        - user

- actions: ["update", "delete"]
      effect: EFFECT_ALLOW
      roles:
        - admin

- actions: ["update", "delete"]
      effect: EFFECT_ALLOW
      roles:
        - user
      condition:
        match:
          expr: request.resource.attr.owner == request.principal.id
```