Amazon Cognito Activity

Ingest Amazon Cognito user pool sign-in activity and API calls into Bronto through Amazon Data Firehose log export and CloudTrail.

Amazon Cognito user pools can export user activity logs (sign-in, sign-up, and other auth events with risk assessment) as JSON. Export needs the Plus feature plan with threat protection in Audit-only or Full-function mode. API calls are recorded separately in AWS CloudTrail.

​

Recommended method

Amazon Data Firehose — export user activity logs directly to a Firehose stream that points at Bronto. Bronto parses the JSON automatically.

1. In the Amazon Cognito console, open the user pool and choose the Advanced security tab.
2. Under Export user activity logs, choose Edit and select Activate user activity log export.
3. For Logging destination, choose Amazon Data Firehose stream and select your Bronto stream.

Set x-bronto-dataset in the stream’s Parameters to choose the dataset. See Amazon Data Firehose setup.

​

Alternatives

• CloudWatch Log Forwarder for API calls — configure CloudTrail to deliver Cognito events to a CloudWatch Log Group, and the forwarder streams them into Bronto.

See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​

References

• Amazon Cognito — exporting logs from user pools
• Amazon Cognito — logging API calls with CloudTrail