How to avoid hardcoding AWS Cognito data in the app - amazon-web-services

Question

I am creating an Electron app that connects to AWS services. Before services can be accessed, the users need to authenticate using AWS Cognito. In order for users to authenticate, I need to hardcode in the client app the app region, user pool id, identity pool id, and the app client id. Hard coding this is a terrible idea because these values will change from client to client.
In my app the users NEVER interact directly with the database, otherwise I would have them query the database for this data. Users connect to an Elastic Beanstalk endpoint and my EC2 instances are the only ones allowed to communicate with the database. This improves security.
What is the best way to avoid hard coding this kind of data?

Answer 1

Generally, config should be stored in the environment (see https://12factor.net/).
What this means differs for different environments, and I know nothing about electron, but your configuration values will be known at build-time, so when you are building your clients, you could build an environment.js file whose values can be referenced from your app.
Example using CloudFormation and CodePipeline
So, perhaps you are using CloudFormation to provision your Cognito infrastructure. In this case, you can export variables that can be referenced by other CloudFormation templates.
These exported app client id, user pool id, identity pool id, etc, can be injected them into a CloudFormation template that defines a CodePipeline instance that you might use to build your electron app, of which the following could be a fragment:
...
BuildElectronProject:
Type: AWS::CodeBuild::Project
Properties:
Name: electron-build
Artifacts:
Type: CODEPIPELINE
Environment:
ComputeType: BUILD_GENERAL1_SMALL
EnvironmentVariables:
-
Name: AWS_REGION
Value: !Ref 'AWS::Region'
-
Name: USER_POOL_ID
Value: !ImportValue 'user-pool-id'
-
Name: SERVER_URL
Value: !Join
- ''
-
- !If [ IsProd, 'https://', 'http://' ]
- !FindInMap [ Environments, !Ref Environment, ServerUrl ]
...
Then, when you build your app, you can use the environment variables in CodeBuild to create the environment.js file that is included as part of your distributable electron build.