Can I make a call to AWS Cognito via a Lambda through the API gateway?

Question

My current stack is like this:

1. User creates an account via AWS Cognito
2. A post confirmation lambda is triggered which then adds further user details to a database

My database uses the sub id generated by cognito as the userId so they are the same. I also copy the email address as the Username in my database. My intention is to use Cognito for Authentication and my own database for the functionality of my app.

However if the user wishes to update their email address I need to amend this in both cognito and my database. My first attempt made a call to cognito in my lambda using admin_update_user_attributes but soon realised it was blocked from making external calls to the internet, so i created a nat gateway which worked but it simply costs way too much!

My second idea was to go through cognito, having my front end make the call and then have cognito trigger a lambda to update my database but I don't think this is possible.

Is there a configuration or something I'm missing to be able to access AWS cognito via a lambda through the API gateway as they are both AWS services.

I dont want to make two seperate calls via my frontend as this creates a risk of one being completed but not the other.

Thanks

Chromaticity

Answer 1

A NAT gateway will be needed if you have your Lambda function in a VPC as there are no Cognito VPC endpoints at this time.

List of currently supported AWS services with endpoints.

If you are using a DB like Dynamo, the Lambda function does not need to be in a VPC so you could achieve the usecase you mentioned above.

Another option could be to do the Cognito update asynchronously, so your Lambda could potentially use VPC endpoints to put an object in SQS and then have a Lambda poller (outside VPC) to poll the messages and update Cognito. Or achieve a similar usecase by making use of private API Gateways.

These are just potential ideas which I have not done myself.

Fluoroscope

Thanks for the reply. Initially I tried with dynamodb but had the same issue whereby I required a NAT gateway... I later found it didnt really meet my needs anyway. My database is Neo4J on a EC2 instance. If I understand your reply correctly I am wondering if it possible to have a seperate lambda that can make the call to Cognito and then to my api-gateway > lambda > EC2... this seems very long winded though. Also if anything I say sounds daft forgive me, this is my first rodeo. Thanks – Chromaticity

@stackOp please read all the original post :) "so i created a nat gateway which worked but it simply costs way too much!" – Chromaticity

Your ideas are interesting. I have this case where my pgsql is in ec2 and I'm trying to pull information from cognito. Since it's read only do you have anymore ideas? I want it to be cost effective solution. – Kinney