Inside Figma: securing internal web apps | Figma Blog

Figma built a reusable system for securely exposing internal web applications while preserving a smooth employee experience. The design combines AWS Application Load Balancers, Cognito, Okta, SAML, Lambda, and Terraform to enforce zero-trust authentication and centralized authorization. Its main conclusion is that carefully integrated, managed cloud components can provide strong security without creating excessive operational work for a small security team.

Security Requirements for Internal Applications

Figma’s internal web tools support critical workflows such as software deployment and customer support, making them attractive targets for attackers.

The system was designed around five requirements:

• Smooth user experience: Authentication should be fast, reliable, and convenient.
• Zero-trust access: Network location alone should not establish trust.
• Modern authentication: Applications should be able to use protections such as WebAuthn.
• Centralized authorization: IT and security teams should centrally assign, monitor, and revoke permissions.
• Low operational overhead: The system should minimize ongoing SRE and security-team toil.

Technologies Used

The architecture relies primarily on managed services and infrastructure-as-code:

• SAML: Exchanges identity, group membership, and role assertions between services.
• AWS Application Load Balancer: Acts as a managed reverse proxy and routes authenticated HTTP/HTTPS traffic.
• AWS Cognito: Provides user-pool functionality and integrates with federated SAML identity providers.
• AWS Lambda: Runs code in response to configured events without managing servers.
• Terraform: Defines and automates AWS and Okta configuration through reusable modules.

Application Load Balancers, Cognito, and Okta

Figma uses AWS for infrastructure and Okta for employee authentication and authorization.

• ALBs can authenticate traffic using OIDC, but Okta charges extra for OIDC support.
• Figma instead uses the ALB’s SAML authentication capability together with an AWS Cognito user pool.
• Terraform modules automate the creation and configuration of the required ALB and Cognito resources.
• These modules allow infrastructure engineers to quickly deploy internal applications protected by the company’s Okta environment.
• The Cognito user pool disables self-registration.
• Each pool connects to a Cognito identity provider backed by a SAML Okta application created for the specific internal application.
• Attribute mappings are configured so user information such as email and profile is passed through the authentication flow.