4 ms·

Yes, but cognito endpoints and pools ids are regional and globally unique, and there is no way that I know of to setup duplicate userpools in multiple regions a

Yes, but cognito endpoints and pools ids are regional and globally unique, and there is no way that I know of to setup duplicate userpools in multiple regions and have requests served by either region. That means the customer IDP side would need to have two different SAML apps configured for each region...

sk5t 6y ago
Ah, I see what you mean. It does seem like you'd want a more complex arrangement of trusts to keep things simple on the leaves; or else avoid using a product that requires generating a hundred scattered security authorities.
myleshenderson 6y ago
This was shared with me today: https://medium.com/@nealrp/aws-cross-region-cognito-replication-c764da1f29c0 https://medium.com/@nealrp/aws-cross-region-cognito-replicat...
- sk5t 6y ago
  Quite superficial don’t you think?
- paragraft 6y ago
  That design raises the question as to what happens to passwords. Do they get replicated in the global table in plaintext? Or are you still forced to do a global user password reset if you want to failover to another user pool?