Amazon Cognito
Amazon Cognito is an Amazon Web Services service used for authentication, authorization, and user management for web or mobile applications, letting developers add sign-up, sign-in, and access control quickly and easily. It lets customers sign in directly through a third-party or social identity provider instead of managing credentials themselves.
Key points
- Two main components, usable separately or together:
- User pools — user repositories that hold user profile details and provide sign-up and sign-in options for app users; a standards-based Identity Provider supporting OAuth 2.0, SAML 2.0, and OpenID Connect.
- Identity pools — provide temporary, limited-permission AWS credentials so users can access other AWS resources without re-entering their credentials; useful for both authenticated and unauthenticated identities.
- Typical flow: an app authenticates and gets tokens from a Cognito User Pool, exchanges the token for AWS credentials via a Cognito Identity Pool, then accesses other AWS services with those credentials.
- Social identity providers supported: Google, Facebook, Amazon, and other social media login credentials.
- Enterprise identity providers supported: Microsoft Active Directory via SAML.
- Supports multi-factor authentication (MFA) for user pool users, adding a second sign-in factor beyond username/password.
- Distinct from AWS Identity and Access Management (IAM) and AWS IAM Identity Center (Single Sign-On), which manage sign-in for AWS administrators/workforce users across accounts and the AWS Management Console — Cognito manages identities for end users of an organization’s own apps, not AWS access itself.
- Distinct from AWS Directory Service, which provisions and manages actual Microsoft Active Directory infrastructure — Cognito is not one of its directory types.
- A Cognito user pool is a protectable resource type for AWS WAF web ACLs, alongside CloudFront, API Gateway, and Application Load Balancer.
- User pools are priced in three feature tiers: Lite (basic sign-up/sign-in, social and SAML/OIDC federation), Essentials (adds Managed Login and passwordless sign-in with passkeys, email, or SMS; the default for new user pools), and Plus (adds threat protection — risk-based adaptive authentication, compromised-credentials detection, and exporting authentication event logs).