I have a web application hosted on an EC2 instance that I own. I did not write the web application and do not have the source code for it, but I can run it and allow it to be accessed through the EC2 instance's public IP and a specific port (for example https://XX.XX.XX.XX:5000). It is connected to Route53 through a domain name that redirects to this address (for example, https://resource.example.com).
I only expect to have local friends using this web application (approximate 5-20 users). However I am having issues with random people stumbling upon the domain and messing around with the web application.
I would like to secure it somehow, preferably with an AWS service like Cognito. I do not want to whitelist IPs because I can expect my friends to move around to different WiFi networks (possibly in different cities or countries) and would like them to still have access. I do not have a lot of cloud development experience and would like a simple and fast approach.
The application flow would look something like this: user tries to access https://XX.XX.XX.XX:5000 or https://resource.example.com. User is not allowed access yet because they are not authenticated, and are automatically redirected to the Cognito hosted UI. They then sign in (using an account I provided them), and are redirected back to https://resource.example.com where they can use the web application freely. After some time their authentication token expires and they are no longer given access to the web application.
There are many tutorials on how to do this with applications that you own or can modify freely, but is it possible to do this when you cannot modify the underlying web application? For example, some sort of service monitoring connections to and from the EC2 instance that automatically checks for authentication and redirects to the Cognito hosted UI if authentication is invalid.