Auth And Access

Cognito

GiantRealmsAuth owns the product user pool, hosted UI domain, user pool client, and operator groups. The first groups are:

• admin
• developer
• hitl-operator

The stack also creates a separate admin-created-only dev edge user pool. That keeps the future dev URL gate independent from product users.

Manual user setup:

• Add dev-site users in the GiantRealmsAuth.DevEdgeUserPoolId pool.
• Add API/product operators in the GiantRealmsAuth.UserPoolId pool.
• Assign product operators to admin, developer, or hitl-operator groups.

Dev URL Blocker

GiantRealmsWeb blocks direct *.cloudfront.net access on every static surface. Each distribution only serves its expected custom hostname.

dev.giantrealms.com also has a Lambda@Edge sign-in gate backed by the admin-created-only dev edge Cognito user pool. Operators are manually added to that pool, then sign in before CloudFront serves the static dev surface.

This is a URL gate for the static dev surface. Product access decisions still belong behind Cognito-authorized API routes.

Operator API

GiantRealmsApi owns the first protected API surface:

• HTTP API with Cognito JWT authorization.
• Internal wiki authoring is intended to be backed by git-managed MDX files and surfaced through the protected wiki/CMS workflow.
• DynamoDB table giantrealms-document-pages.
• EventBridge bus giantrealms-domain-events.

Use scripts/sync-runtime-env.sh after stack changes to refresh local frontend configuration from CloudFormation outputs.