Amazon Cognito

What it is

Amazon Cognito is an identity platform for web and mobile apps. It is a user directory, an authentication server, and an authorization service for OAuth 2.0 access tokens and AWS credentials. It authenticates users from its built-in directory, from enterprise directories, and from consumer identity providers such as Google, Facebook, Amazon, and Apple.

Choose Cognito when a question asks how customers or app users can sign up and sign in, sign in with social or enterprise identity providers, or access AWS resources directly from a mobile or web app with temporary credentials. For employees signing in to AWS accounts, use IAM Identity Center.

Two components

	User pools	Identity pools
Answers	Who is this user? (authentication)	What AWS access do they get? (authorization to AWS)
Gives the app	Tokens (ID, access, and refresh tokens) based on OIDC (OpenID Connect)A sign-in standard built on OAuth 2.0 that lets an application learn who a user is from a trusted identity provider, through a signed ID token. IAM accepts OIDC providers, so that, for example, a GitHub Actions workflow can assume an IAM role.Glossary entry	Temporary AWS credentials for IAM roles
Features	Sign-up and sign-in, managed login pages, MFA (Multi-factor authentication)Signing in with two or more different kinds of proof, such as a password plus a code from a phone app or a security key. AWS recommends MFA for the root user and for every human user.Glossary entry (SMS, email, TOTP), federation with social, SAML (Security Assertion Markup Language)An XML-based standard for passing sign-in information from an identity provider, such as Microsoft Entra ID or Okta, to a service. AWS accepts SAML 2.0 for single sign-on, directly in IAM or through IAM Identity Center.Glossary entry, and OIDC providers, Lambda triggers to customize flows	Authenticated and guest (unauthenticated) access, role selection by rules or by claims in the user's token
Typical use	Protect an API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry or app with sign-in	Let the app upload to S3 or call DynamoDB directly

They work independently or together: a user signs in to a user pool, and the app exchanges the user pool tokens through an identity pool for temporary AWS credentials.

Cognito user pools and identity pools. An app user signs in to a user pool, which handles sign-in and MFA and returns tokens. The app exchanges the tokens with an identity pool, which maps users to IAM roles and returns temporary AWS credentials, and the app uses them to call Amazon S3 or DynamoDB directly.

Integrations

API Gateway: use a Cognito user pool authorizer to protect REST (Representational state transfer)A style of web API in which resources are named by URLs and handled with standard HTTP methods, such as GET, PUT, and DELETE, and the server keeps no session state between requests. Amazon API Gateway builds REST APIs.Glossary entry APIs, or a JWT (JSON Web Token)A compact, signed token that carries claims as JSON, such as who the user is and when the token expires. Amazon Cognito issues JWTs, and Amazon API Gateway can check them before passing a request to the backend.Glossary entry authorizer for HTTP (Hypertext Transfer Protocol)The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.Glossary entry APIs.
Application Load Balancer: an HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry listener can authenticate users with Cognito before forwarding requests.
AWS Amplify sets up Cognito for app sign-in.

Security, resilience, performance, and cost

Security

Turn on MFA.
Threat protection, in the Plus feature plan, detects risks such as compromised credentials and unusual sign-in activity, and can require extra verification or block sign-ins.
Grant identity pool roles Least privilegeGiving each person or system only the permissions it needs for its task, and no more. In IAM, this means starting with no access and allowing specific actions on specific resources.Glossary entry, and use policy variables such as the user's identity ID to restrict each user to their own data.

Resilience and performance

A managed, Regional service that scales to millions of users.

Cost

User pools have feature plans:
- Lite: low cost, basic authentication.
- Essentials: the default for new user pools, with advanced authentication features such as choice-based sign-in and email MFA.
- Plus: adds threat protection.
Each plan is charged per monthly active user.

Cognito or another option?

If the requirement is	Choose
Customers sign up and sign in to our app	Cognito user pool
Sign in with Google, Facebook, Apple, or a SAML IdP	Cognito user pool federation
Mobile app uploads directly to S3 with temporary credentials	Cognito identity pool
Guest users read public data before signing in	Identity pool unauthenticated role
Protect an API with user sign-in	API Gateway with a Cognito authorizer
Employees sign in to AWS accounts	IAM Identity Center

Reverse mindmap: when the question points here

Is it Amazon Cognito?

Yes, when the question says
- Sign-up and sign-in for a web or mobile app leads to Cognito user pool
- Social sign-in with Google or Facebook leads to User pool federation
- Millions of customer identities leads to Cognito
Choose the component
- App needs AWS credentials for S3 or DynamoDB leads to Identity pool
- Guest access before sign-in leads to Identity pool unauthenticated role
- Tokens to call our API leads to User pool tokens with an API Gateway authorizer
- Authenticate at the load balancer leads to ALB with Cognito
Secure it
- MFA for users leads to User pool MFA
- Detect compromised credentials leads to Threat protection, Plus plan
No, when the question says
- Employees to AWS accounts leads to IAM Identity Center

Key takeaways

Cognito handles customer identity for web and mobile apps.
User pools authenticate users and issue tokens, with MFA and federation with social, SAML, and OIDC providers.
Identity pools exchange identities, including guests, for temporary AWS credentials through IAM roles.
It integrates with API Gateway authorizers, ALB authentication, and Amplify.
Feature plans are Lite, Essentials (the default), and Plus (with threat protection), priced per monthly active user.