Cognito Wrapper
Overview
Cognito Wrapper
Amazon Cognito is a developer-centric identity platform for web and mobile apps. It provides secure, scalable user authentication and access control, supporting password-based login, MFA, passwordless authentication, social identity providers, and enterprise SSO via SAML and OIDC, with a fully managed identity store that scales to millions of users.
The Cognito Wrapper brings your Cognito user pool data into Postgres as a queryable foreign table. Query users with plain SQL and join them against your application data. It is read-only and works with Supabase Vault for secure AWS credential management.
Preparation
Before you get started, make sure the wrappers extension is installed on your database:
_10create extension if not exists wrappers with schema extensions;
and then create the foreign data wrapper:
_10create foreign data wrapper cognito_wrapper_10 handler cognito_fdw_handler_10 validator cognito_fdw_validator;
Secure your credentials (optional)
By default, Postgres stores FDW credentials inside pg_catalog.pg_foreign_server in plain text. Anyone with access to this table will be able to view these credentials. Wrappers is designed to work with Vault, which provides an additional level of security for storing credentials. We recommend using Vault to store your credentials.
_10select vault.create_secret(_10 '<secret access key>',_10 'cognito',_10 'Cognito secret key for Wrappers'_10);
Connecting to Cognito
We need to provide Postgres with the credentials to connect to Cognito, and any additional options. We can do this using the create server command:
With Vault:
_10create server cognito_server_10 foreign data wrapper cognito_wrapper_10 options (_10 aws_access_key_id '<your_access_key>',_10 api_key_id '<your_secret_key_id_in_vault>',_10 region '<your_aws_region>',_10 user_pool_id '<your_user_pool_id>'_10 );
Without Vault:
_10create server cognito_server_10 foreign data wrapper cognito_wrapper_10 options (_10 aws_access_key_id '<your_access_key>',_10 aws_secret_access_key '<your_secret_key>',_10 region '<your_aws_region>',_10 user_pool_id '<your_user_pool_id>'_10 );
Resources
Details
Third-party integrations and docs are managed by Supabase partners.