Authentication with Cognito - where to find logs

Question

We have 2 React Native app are using AWS Cognito for authentication. We use library react-native-aws-cognito-js in our code. The apps are working fine until these 2 days. Apps are experiencing intermittent "Internal Server Error".

How can I find more information about this error? Any tool can help us pinpoint the cause?

Update

From CloudTrail, each API call has an event "CreateNetworkInterface". Many of such API calls have error code "Client.NetworkInterfaceLimitExceeded". What is the cause and solution to this?

According to this AWS Doc (in Chinese), CloudWatch will not write to log when error is due to insufficient IP/ENI. That explains the increase in error number but no logs in CloudWatch.

Upate 2

We have found a scheduled Lambda job which may exhausted IP addresses. We stopped the batch job. But still can't have too many user login to server due to "Client.NetworkInterfaceLimitExceeded" error. I realized that there are many "CreateNetworkInterface" event and few "DeleteNetworkInterface" event. How can I "clean up / reset" all network interface in VPC?

Solution

Short answer: Cloud Trail.

Long answer with a suggestion

Assuming your application code is fine, most likely the cause of your 500 error is based on Cognito's initial limitations (e.g., number of calls per user): https://docs.aws.amazon.com/cognito/latest/developerguide/limits.html.

AWS suggests to use Cloud Trail, for logging Api calls. However I would suggest, to prove the limitations first, add some logs around the api call yourself, and in development you could call your app/api with a high number of calls; and most likely you will see the 500 error due to the limitations. You could do the following in the terminal:

for i in `seq 1 1000`; do curl --cookie SecureCookie=TokenValueFromAWS http://localhost:desirablePort/SecuredPath; done

Comments

[cazzer]

I've been trying to find Cognito logs in CloudTrail for a couple of hours now but I don't see any. Do I need to be in a specific region or have something enabled in Cognito?

[cazzer]

Looks like you can only use CloudTrail to monitor Cognito in the following regions: Asia Pacific (Tokyo), EU (Ireland), and US East (N. Virginia). If you have an existing User Pool somewhere else, you're out of luck at the moment.

[Juli Gupta]

Is there any update to this? I have my user pool set up in US West (Oregon) region. My users are comparing of unable to login. Is there any way I can check any logs to see what is happening?