Learn how to set up and connect your backend resources for authentication in Amplify.

Set up Amplify Auth

Learn more about what Amplify Auth provisions and supports

Usernames

Email

Phone

Learn how to configure passwordless sign-in flows

Passwordless

User attributes

User groups

Multi-factor authentication

External identity providers

Access services without needing to sign in.

Guest access

Learn about how tokens and credentials are used in Amplify applications

Tokens and credentials

Concepts

Learn how to use the Authenticator connected component from the Amplify UI library

Using the Authenticator

Sign-up

Sign-in

Learn how to switch between different auth flows

Switching authentication flows

Sign-out

Manage user sessions

Learn about managing user attributes in your Amplify app

Manage user attributes

Listen to auth events

Delete user account

Use Amazon Cognito Auth plugin to complete a multi step authentication flow

Multi-step sign-in

Learn how to connect your frontend to your backend auth resource

Connect your frontend

Learn how to manage users with Admin Actions

With admin actions

Manage passwords

Manage WebAuthn credentials

Manage devices

Manage applications Cognito users and groups with Amplify console

Manage users with Amplify console

Manage users

Use Amazon Cognito Auth plugin to sign in a user into Amazon Cognito User Pool using user defined custom flow

Custom auth flows

Learn how to customize emails your users receive when signing up

Email customization

Learn how to use Cognito Lambda triggers to customize the authentication lifecycle

Triggers

Learn how to customize the auth lifecycle

Customize auth lifecycle

Use Amazon Cognito Auth plugin to register and authenticate a user with a prebuilt web UI

Enable sign-in with web UI

Understand how to handle persistent data on a device when a user uninstalls the app.

Uninstalling the app

Review the data types gathered by the Amplify library that Apple requires you to disclose in your app's data usage policy when submitting the app to the App Store.

Data usage policy information

Learn how to connect a Microsoft Entra ID provider with SAML

Microsoft Entra ID (SAML)

Learn how to address different business use cases with Amplify Auth

Examples

Learn how to grant access to auth resources

Grant access to auth resources

Learn how to modify Amplify-generated Cognito resources.

Modify Amplify-generated Cognito resources with CDK

Learn how to configure your auth resources for production workloads

Moving to production

Learn more about advanced workflows in the Amplify auth category. This includes subscribing to events, identity pool federation, auth-related Lambda triggers and working with AWS service objects.

Advanced workflows

Use existing Cognito resources

For advanced use cases where Amplify does not provide the functionality, you can retrieve the escape hatch to access the AWSCognito instance.

Use AWS SDK

API References

Learn about the authentication capabilities of AWS Amplify.

Authentication

Create a new cloud API that connects your app with new or existing data sources.

Set up Amplify Data

Learn how to connect your app code to an API.

Connect your app code to API

Mutate application data in an API by generating the client, adding items, updating existing items, deleting items, troubleshooting unauthorized errors, and canceling requests.

Create, update, and delete application data

Read application data using list and get queries. You can filter query results, paginate list queries, specify only the data fields needed, and cancel requests. This guide covers how to perform these tasks to optimize data access in your application.

Read application data

Set up real-time data subscriptions in your app to get live updates, filter those subscriptions on the server side, and unsubscribe when no longer needed.

Subscribe to real-time events

Configure built-in and custom field types.

Add fields to data model

Learn about the types of model relationships and modeling relationships.

Modeling relationships

Define the primary key for a model using single-field or composite identifiers.

Customize data model identifiers

Define the secondary indexes for your data model to optimize query performance

Customize secondary indexes

Disable Operations

Customize your data model

The public authorization strategy grants everyone access to the API, which is protected behind the scenes with an API key. You can also override the authorization provider to use an unauthenticated IAM role from Cognito instead of an API key for public access.

Public data access

The owner authorization strategy restricts operations on a record to only the record's owner. When configured, the owner field (default 'owner') will automatically be added and populated with the identity of the created user. The API will authorize against the 'owner' field to allow or deny operations.

Per-user/per-owner data access

The 'ownersDefinedIn' rule grants a set of users access to a record by automatically creating an 'owners' field to store the allowed record owners. You can override the default owners field name by specifying 'inField' with the desired field name to store the owner information. You can dynamically manage which users can access a record by updating the owner field.

Multi-user data access

The 'private' authorization strategy restricts record access to only signed-in users authenticated through IAM, Cognito, or OpenID Connect, applying the authorization rule to all users. It provides a simple way to make data private to all authenticated users.

Signed-in user data access

The user group authorization strategy allows restricting data access to specific user groups or groups defined dynamically on each data record. Both static and dynamic group authorization options are available, with some limitations around real-time subscriptions when using dynamic group authorization.

User group-based data access

Define a custom authorization rule with a Lambda function.

Custom data access using Lambda functions

Use OpenID Connect with 'private', 'owner', and 'group' authorization strategies.

Use OpenID Connect as an authorization provider

Amplify Data allows you to configure custom identity and group claims instead of using the default Cognito claims, which can be useful if you want to populate claims from an external source like a database or 3rd party auth provider. The example shows how to check the 'user_id' identity claim and the 'user_groups' group claim that could come from a custom pre token generation Lambda trigger. Defining these custom claims provides more flexibility in authorization rules.

Configure custom identity and group claims

Amplify Data uses a 'deny-by-default' authorization model. Function access must be explicitly defined in the schema.

Grant Lambda function access to API and Data

Learn how to customize and combine your authorization rules.

Customize your auth rules

Build search and aggregate queries with Amazon OpenSearch Service and Zero ETL DynamoDB-to-OpenSearch.

Connect to Amazon OpenSearch for search and aggregate queries

Connect to Amazon EventBridge data sources to build event-driven applications with AWS Amplify.

Connect to Amazon EventBridge to send and receive events

Connect to Amazon Polly for Text-To-Speech APIs

Connect to Amazon Bedrock to build generative AI applications with AWS Amplify.

Connect to Amazon Bedrock for generative AI use cases

Connect to Amazon Rekognition for Image Analysis APIs

Connect to Amazon Translate for language translation APIs

Connect to an external HTTP endpoint

Batch DynamoDB Operations

Customize your business logic for queries and mutations.

Add custom queries and mutations

Working with files/attachments

Customize your business logic to create custom real-time subscriptions.

Add custom real-time subscriptions

Learn how to connect your app to existing MySQL and PostgreSQL database.

Connect your app to existing MySQL and PostgreSQL database

Connect to external Amazon DynamoDB data sources with custom queries and mutations

Connect to external Amazon DynamoDB data sources

Learn how to connect your Data API to existing DynamoDB tables, MySQL databases, or PostgreSQL databases.

Connect to existing data sources

Connect to Amplify Data from Next.js Server-side Runtime (SSR).

Next.js server runtime

Connect to Amplify Data from Nuxt.js Server-side Runtime (SSR).

Nuxt.js server runtime

Connect to Amplify Data from Next.js and Nuxt.js Server-side Runtimes (SSR).

Connect to data from Server-side Runtimes

Learn more about implementing optimistic UI with Amplify Data API.

Optimistic UI

Connect to AWS AppSync Events

Modify and customize existing AWS resources generated by the Amplify GraphQL API.

Modify Amplify-generated AWS resources

Manage Data with Amplify console

AWS AppSync Apollo Extensions

Learn how to enable logging for your Amplify data resource

Enable logging

Learn how to enable field level validation in your model schema

Field-level validation

Learn about the data capabilities of AWS Amplify.

Data

Set up Storage

Define granular authorization rules for storage buckets

Customize authorization rules

Upload files

Download files

Get list of files or file properties using Amplify Storage

List file properties

Remove files

Copy files

Listen to storage events

Extend S3 resources

Use AWS SDK for S3 APIs

You can use the Amplify Storage APIs against your own S3 bucket in your account.

Use Amplify Storage with any S3 bucket

Data usage policy

Manage your applications storage files with Amplify console

Manage files with Amplify console

Storage

Use AWS Lambda functions to perform tasks and customize workflows.

Set up a Function

Learn how to configure and consume environment variables and secrets

Environment variables and secrets

Configure Functions

Learn how to configure the aws-amplify client library in function handlers

Configure client library

Learn how to schedule functions to run at specific intervals

Scheduling Functions

Stream execution logs directly to your terminal while Sandbox is running

Streaming logs

Lambda Layers

Extend the capabilities of your Function by granting access to other resources

Grant access to other resources

Use an Auth Pre Signup trigger to allow or deny sign-ups based on email domains

Email domain filtering

Use an Auth Post Authentication trigger to automatically add new users to a group

Add user to group

Use an Auth Post Authentication trigger to automatically a user profile record

Create a user profile record

Use an Auth Pre token generation trigger to override ID token claims

Override ID token claims

Validate user attributes with an Auth trigger

User attribute validation

Use an Auth custom message authentication trigger to customize the message sent to users

Custom message

Leverage Google reCAPTCHA to protect against spam

Google reCAPTCHA challenge

Create a Lambda event source for a Amazon Kinesis Data Stream to trigger Lambda functions in response to real-time events

Frontend Libraries

Authentication

Data

Storage

Functions

Add any AWS service

Troubleshooting