Skip to main content

AWS Solutions Library

Guidance for Okta Phone-Based Multi-Factor Authentication on AWS

Overview

This Guidance demonstrates how to implement a secure and scalable one-time passcode (OTP) delivery solution by using AWS with Okta’s identity platform. The Guidance supports multiple languages and communication methods and stores language-specific message templates in a dynamic, scalable database. This enables you to tailor OTP messages based on users’ preferred languages and delivery channels, such as SMS or voice calls. By using this Guidance, you can implement a reliable, flexible, and secure OTP delivery method that helps you accommodate a diverse user base.

How it works

These technical details feature an architecture diagram to illustrate how to effectively use this solution. The architecture diagram shows the key components and their interactions, providing an overview of the architecture's structure and functionality step-by-step.

Download the architecture diagram

Get Started

Deploy this Guidance

Use sample code to deploy this Guidance in your AWS account
Sample code

Well-Architected Pillars

The architecture diagram above is an example of a Solution created with Well-Architected best practices in mind. To be fully Well-Architected, you should follow as many Well-Architected best practices as possible.

This Guidance uses Lambda, API Gateway, and Amazon SQS to implement a serverless approach that provides scalability, flexibility, and ease of maintenance. For example, Lambda right-sizes its functions based on the minimum amount of memory and CPU required to complete their tasks. If one function encounters an error or exception, Lambda sends the failed event to an Amazon SQS dead-letter queue for further investigation and troubleshooting. Additionally, Amazon CloudWatch provides critical monitoring for proactive issue detection and resolution, supporting operational excellence.

Read the Operational Excellence whitepaper

This Guidance enhances security by implementing strong access control and data protection mechanisms. AWS WAF protects the API Gateway endpoint by applying managed rules to block malicious traffic. A custom Lambda function acts as an authorizer to validate JWTs before allowing requests to proceed. This authorizer decodes the JWT (which uses Okta’s public key to validate the signature) and checks the expiration time to confirm token validity. IAM manages access permissions, using the principle of least privilege to make sure that only authorized users and services can access resources. Additionally, AWS Key Management Service (AWS KMS) encrypts sensitive data, such as OTPs, and it encrypts CloudWatch logs to protect the confidentiality of recorded information.

Read the Security whitepaper

This Guidance supports reliability through distributed workloads, error handling mechanisms, durable data storage, and a highly available messaging service. It distributes Lambda functions across multiple Availability Zones (AZs), helping you avoid the risk of a single point of failure caused by an AZ outage. The Amazon SQS dead-letter queue provides reliable message delivery by handling errors and retries, and it enables you to investigate any failed message processing. Additionally, DynamoDB offers a highly available and durable data store for user preferences and message templates. Finally, AWS End User Messaging enhances reliability by providing a highly available and scalable messaging service for SMS and voice communication.

Read the Reliability whitepaper

This Guidance uses serverless services so that you can quickly retrieve and process data without the need to manually manage infrastructure. Lambda scales automatically with your workloads and right-sizes its functions to achieve efficient resource use, and DynamoDB facilitates quick and efficient data retrieval. AWS End User Messaging converts text to speech on-demand for voice calls.

Read the Performance Efficiency whitepaper

This Guidance minimizes costs by using on-demand, pay-as-you-go services. DynamoDB provides a flexible pricing model, and its on-demand capacity mode adjusts to workload volume, helping you reduce costs. For Lambda, you only pay for the compute time you consume, and its scalability helps you optimize costs.

Read the Cost Optimization whitepaper

This Guidance uses scalable, on-demand services to reduce the environmental impact of your cloud workloads and minimize waste. Lambda automatically scales on demand, helping you avoid the use of idle resources. Additionally, DynamoDB provides an on-demand mode that scales with the workload, delivering efficient resource use. Both services align with best practices for minimizing hardware usage and energy consumption.

Read the Sustainability whitepaper

Disclaimer

The sample code; software libraries; command line tools; proofs of concept; templates; or other related technology (including any of the foregoing that are provided by our personnel) is provided to you as AWS Content under the AWS Customer Agreement, or the relevant written agreement between you and AWS (whichever applies). You should not use this AWS Content in your production accounts, or on production or other critical data. You are responsible for testing, securing, and optimizing the AWS Content, such as sample code, as appropriate for production grade use based on your specific quality control practices and standards. Deploying AWS Content may incur AWS charges for creating or using AWS chargeable resources, such as running Amazon EC2 instances or using Amazon S3 storage.