[アップデート] Amazon Cognito で高度なセキュリティを有効化した際にユーザーアクティビティログを外部サービスへ転送出来るようになりました

## 管理者が用意した初期情報で初回の認証
% cat hoge.json
{
    "AuthFlow": "USER_PASSWORD_AUTH",
    "AuthParameters": {
        "USERNAME": "hoge0808",
        "PASSWORD": "111111"
    },
    "ClientId": "g0n17akfs8hkb8hmlqh38r9tg"
}
% aws cognito-idp initiate-auth --cli-input-json file://hoge.json  
{
    "ChallengeName": "NEW_PASSWORD_REQUIRED",
    "Session": "hogehogehoge",
    "ChallengeParameters": {
        "USER_ID_FOR_SRP": "hoge0808",
        "requiredAttributes": "[]",
        "userAttributes": "{\"email_verified\":\"true\",\"email\":\"[email protected]\"}"
    }
}
## デフォルトパスワードからの変更を要求されるので変更対応
% aws cognito-idp respond-to-auth-challenge --generate-cli-skeleton > hoge2.json
% cat hoge2.json
{
    "ClientId": "g0n17akfs8hkb8hmlqh38r9tg",
    "ChallengeName": "NEW_PASSWORD_REQUIRED",
    "Session": "hogehogehoge",
    "ChallengeResponses": {
        "USERNAME": "hoge0808",
        "NEW_PASSWORD": "222222"
    }
}
% aws cognito-idp respond-to-auth-challenge --cli-input-json file://hoge2.json
{
    "ChallengeParameters": {},
    "AuthenticationResult": {
        "AccessToken": "hogehogehoge",
        "ExpiresIn": 3600,
        "TokenType": "Bearer",
        "RefreshToken": "hogehogehoge",
        "IdToken": "hogehogehoge"
    }
}
# 変更後のパスワードで認証（成功）
% cat hoge.json
{
    "AuthFlow": "USER_PASSWORD_AUTH",
    "AuthParameters": {
        "USERNAME": "hoge0808",
        "PASSWORD": "222222"
    },
    "ClientId": "g0n17akfs8hkb8hmlqh38r9tg"
}
% aws cognito-idp initiate-auth --cli-input-json file://hoge.json
{
    "ChallengeParameters": {},
    "AuthenticationResult": {
        "AccessToken": "hogehogehoge",
        "ExpiresIn": 3600,
        "TokenType": "Bearer",
        "RefreshToken": "hogehogehoge",
        "IdToken": "hogehogehoge"
    }
}
# 変更後のパスワードで認証（失敗）
% cat hoge.json
{
    "AuthFlow": "USER_PASSWORD_AUTH",
    "AuthParameters": {
        "USERNAME": "hoge0808",
        "PASSWORD": "333333"
    },
    "ClientId": "g0n17akfs8hkb8hmlqh38r9tg"
}
% aws cognito-idp initiate-auth --cli-input-json file://hoge.json

An error occurred (NotAuthorizedException) when calling the InitiateAuth operation: Incorrect username or password.

{
    "eventTimestamp": "1723070073369",
    "eventSource": "USER_AUTH_EVENTS",
    "logLevel": "INFO",
    "message": {
        "version": "1",
        "eventId": "7f151463-1488-428f-a5c1-9f9c80cf2114",
        "eventType": "SignIn",
        "userSub": "0784fae8-c051-70ff-b12c-0e32600fdd02",
        "userName": "hoge0808",
        "userPoolId": "ap-northeast-1_EcsdFoftu",
        "clientId": "g0n17akfs8hkb8hmlqh38r9tg",
        "creationDate": "Wed Aug 07 22:34:33 UTC 2024",
        "eventResponse": "InProgress",
        "riskLevel": "",
        "riskDecision": "PASS",
        "challenges": [
            "Password:Success"
        ],
        "deviceName": "Other, Other",
        "ipAddress": "xxxx:xx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx",
        "requestId": "7f151463-1488-428f-a5c1-9f9c80cf2114",
        "idpName": "",
        "compromisedCredentialDetected": "false",
        "city": "Sapporo",
        "country": "Japan",
        "eventFeedbackValue": "",
        "eventFeedbackDate": "",
        "eventFeedbackProvider": ""
    },
    "logSourceId": {
        "userPoolId": "ap-northeast-1_EcsdFoftu"
    }
}