Amazon Cognito

Managed authentication and authorization for your app's users — sign-up, sign-in, and temporary AWS credentials.

Verified against AWS documentation · 2026-08-28

Key facts

01User Pools = authentication (who are you) — a user directory that handles sign-up, sign-in, MFA, and returns JWT tokens
02Identity Pools = authorization (what can you access) — swaps an identity for temporary AWS credentials via STS, including unauthenticated guest access
03Federation: sign in with Google, Facebook, Apple, Amazon, or corporate SAML 2.0 / OIDC providers — Cognito is the broker so your app only speaks one token format
04For app users (customers), not workforce — employees logging into AWS itself is IAM Identity Center, not Cognito

Phrases and scenarios that point here.

"Sign-up / sign-in for a web or mobile app", "user directory", "social login" → User Pools
"App users need direct access to S3 / DynamoDB", "temporary AWS credentials", "guest access" → Identity Pools
"Millions of users" + "minimal operational overhead" for auth → Cognito over building on EC2/DynamoDB
"MFA", "adaptive authentication", "compromised credential detection" for app users → Cognito threat protection

Workforce/employee SSO into AWS accounts and business apps → IAM Identity Center
Service-to-service or AWS-resource permissions without human users → IAM roles/policies
Managed Microsoft AD or domain-joined workloads → AWS Directory Service

01Mobile app login: think hotel front desk (User Pool checks you in and hands you a keycard/JWT) vs. the keycard itself opening specific doors (Identity Pool grants scoped AWS access)
02Photo-sharing app where each signed-in user uploads directly to their own S3 prefix — Identity Pool issues per-user temporary credentials, no backend proxy needed
03SaaS product offering "Continue with Google" alongside email/password, with one consistent token your API validates regardless of how the user signed in
04B2B app where enterprise customers demand login via their own corporate IdP — federate their SAML provider into your User Pool without rebuilding auth per customer
05Guest mode: let unauthenticated users browse with read-only AWS access via Identity Pools, then upgrade to full access after sign-up

01User Pools bill per monthly active user (MAU) — a user counts only in months they perform an identity operation (sign-in, sign-up, token refresh); dormant users are free
02Three tiers since late 2024: Lite, Essentials (default for new pools), and Plus (adds threat protection) — Essentials/Lite include 10,000 free MAUs indefinitely, Plus has no free tier
03SAML/OIDC-federated users bill at a separate (higher) rate with only 50 free MAUs — enterprise SSO is the line item that surprises people
04Machine-to-machine (client credentials) auth bills per token request and per app client, with no free tier
05Identity Pools are free — you only pay for the AWS resources users access; SMS for MFA/verification bills separately through SNS