Secure mission access

Sign in to Compass

This team demo uses password-only Cognito access. Roles and every downstream row a user can see still derive from one short-lived Cognito JWT.

Team demo access

Team-demo MFA is disabled (MfaConfiguration: OFF) so invited teammates can sign in with their password without enrolling an authenticator.
16-character minimum password, upper/lower/number/symbol all required; temporary passwords expire in 7 days.
Sign-up is admin-only - the three demo identities are seeded, never self-registered.
ID and access tokens live 1 hour and refresh tokens live 8 hours. Password-only access does not change route authorization, role checks, or row-level policy.
Production target: require MFA under the approved security baseline before processing operational data.

Zero trust, least privilege

Deny-by-default on every route - the HttpApi's default authorizer is the Cognito JWT authorizer; there is no unauthenticated route.
Re-verified, not just trusted - a second Lambda authorizer independently checks the same token's signature against the pool's live JWKS, issuer, and expiry before deriving role/org_unit. Anything it can't fully verify is denied.
One group, one row scope - compass-poweruser → org_unit ONR-Corporate (whole portfolio); compass-viewer → org_unit Code-30 (its own rows only).
Enforced again at the database - grants_curated runs FORCE ROW LEVEL SECURITY, and the app's runtime role isn't the table owner, so it can't bypass the policy even by accident.
Column-level, too - the viewer role has no SELECT grant on amount_usd; award dollar figures are unreadable, not just hidden in the UI.
Every export is audited - writes an immutable audit_log row, and rows above the export cap require an approval before they'll run.