Wiz Supports FedRAMP Authorization by Migrating to Amazon Cognito

Wiz was founded in 2020 to help organizations protect their cloud environments with a unified cloud-security solution. Wiz’s security solution works by creating a normalization layer between cloud environments. This layer helps customers identify and remove risks. In its first 3 years, Wiz powered its business-to-business (B2B), software-as-a-service solution with over 50 AWS services.

Before migrating to Amazon Cognito, Wiz used a third-party CIAM solution as its primary authentication service. However, Wiz’s developers would have to make special configurations to deploy new features. “We had a lot of ideas on how we could add more features to support our ever-growing enterprise customers,” says Solal Raveh, field chief technology officer of EMEA at Wiz. “We would have to spend much more engineering time to implement such features.”

Wiz had built most of its tech stack on AWS, which factored into the team’s decision to use Amazon Cognito. “The ability to interconnect AWS services as part of our authentication flow was a winning ticket,” says Raveh. Further, by using Amazon Cognito, Wiz’s customers were able to select which Region they would like to store their user profile data in. By selecting their AWS Region, Wiz’s customers can comply with regulations such as the General Data Protection Regulation (GDPR), which requires businesses to manage data within specific geographic locations.

To power its offering with Amazon Cognito and automate the logic for the authentication flow, Wiz uses AWS Lambda—a serverless, event-driven compute service. And to securely store its customers’ metadata, Wiz uses Amazon DynamoDB—a serverless, NoSQL, fully managed database with single-digit millisecond performance at nearly any scale.

Many of Wiz’s customers operate in heavily regulated industries and regions; therefore, service availability is a top priority while migrating user stores. So the Wiz team decided to develop its infrastructure to support tokens from both Amazon Cognito and the previous provider. Wiz built an API-based self-service portal for its customers to incentivize them to migrate their users to Amazon Cognito. “We embedded the portal experience into our solution so that tenant administrators would have the power to migrate everything they needed,” says Raveh.

The portal guides customers through four major steps: setting up and testing their new single-sign-on entry, porting users and scripting pipelines to Amazon Cognito, validating users’ identities, and cleaning up remaining artifacts from Wiz’s preexisting CIAM provider. “We let our customers choose the suitable time for migration while giving them the tools to make it happen,” says Raveh. “We also published a blog explaining why we decided to migrate to Amazon Cognito so that they would be part of the decision-making.”

To further motivate its customers to migrate, the Wiz team rolled out new features such as multitenancy flows and disaster recovery. “Using AWS services as building blocks around Amazon Cognito, we can be more flexible, be granular with our solution development, and achieve high service-level agreements,” says Raveh. As customers migrated to Amazon Cognito, Wiz lowered its CIAM costs by 70 percent.

By October 2023, 99.5 percent of Wiz’s customers migrated their users to Amazon Cognito. Thus, customers managed to immediately improve their reliability as a result of achieving over 99.9 percent availability. Wiz has also received FedRAMP authorization for its cloud-based solution, Wiz for Government. “By using Amazon Cognito, and with all the moving pieces meeting regulatory requirements, we were able to serve our customers and achieve our goals,” says Raveh.

Several of Wiz’s customers have reached out to learn about the multitenancy migration. “We’ve had many friendly requests from prospects and joint customers to reference our architecture,” says Raveh. “People want to know how Wiz did the migration. A couple of them have already started their own journeys.” Wiz completed its migration to Amazon Cognito in June 2024.

Looking ahead, Wiz will continue to roll out more features for B2B and customer identity and access management (CIAM). These include features that help its enterprise customers cross-replicate versions of their B2B user stores. “There are always hurdles and road bumps with a migration. The question is how you handle them,” says Raveh. “We had challenges in design, development, and production, but everything turned out all right. Working alongside AWS was, in one word, splendid.”