ACKF logoACKF
Security, Identity, and Compliance

Amazon Cognito

View on GitHub

Amazon Cognito

Amazon Cognito is a managed identity service that provides user sign-up, sign-in, and access control for web and mobile applications. It issues JSON Web Tokens (ID, access, refresh) and supports federation with social and enterprise identity providers. Cognito typically sits at the authentication and identity layer of an application architecture to provide tokens and user profile management.

🗂 Resource Category

Security, Identity, and Compliance • Application Integration

🧠 Exam Memory Hook

Think: "App authentication + OAuth/OIDC tokens + federation = Amazon Cognito"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and patches the underlying service platform, network, and physical infrastructure that run Cognito and its control plane; AWS maintains the managed runtime, service APIs, and built-in features such as hosted UI, token issuance, and the federation adapters. AWS is responsible for the availability of the Cognito control plane and for securing the infrastructure and service software it runs.

Customer responsibilities: The customer configures user pools, identity pools, app clients, attribute mappings, authentication flows, hosted UI settings, IAM roles for identity pools, password policies, MFA settings, Lambda triggers, and monitoring; the customer manages user data, user lifecycle, access control decisions, compliance requirements, and application integration. The customer must also secure application credentials, client secrets, and ensure appropriate CloudWatch monitoring and logging are configured for operational visibility.

Patching responsibilities: AWS patches the physical infrastructure, hypervisor, guest operating systems used by the managed platform, and the Cognito managed runtime and service components. The customer is responsible for patching their application code, application runtimes, libraries, dependencies, and any services they operate (for example Lambda function code and runtime layers) that integrate with Cognito.

🏗 Typical Architecture

💡 Top 5 Features

  • Managed user directory and authentication flows via User Pools for sign-up and sign-in.
  • Federation support with social IdPs and enterprise IdPs using OAuth 2.0, OpenID Connect, and SAML 2.0.
  • Identity Pools (federated identities) to exchange authenticated identities for temporary AWS credentials.
  • Hosted authentication UI and customizable sign-in/sign-up flows with Lambda triggers for custom logic.
  • Issues JSON Web Tokens (ID, access, refresh) compatible with standard OAuth/OIDC flows.

✅ Top 5 Use Cases

  • Provide user authentication and token issuance for mobile and single-page applications to protect APIs.
  • Enable social login and enterprise SAML/OIDC federation to reduce custom identity provider work.
  • Exchange federated identities for temporary AWS credentials to allow client-side access to AWS resources.
  • Implement custom authentication or user workflow logic using Lambda triggers for pre/post authentication events.
  • Host a standard sign-in/sign-up experience with customizable UI to accelerate application launch.

🏗 Architecture Placement

Amazon Cognito sits at the authentication and identity layer, receiving sign-in and federation requests from web or mobile clients and issuing JWTs used by API Gateway or backend services; it can exchange identities for temporary AWS credentials when identity pools are used. User Pools and Identity Pools are configured at the account and regional level and are typically invoked directly by client applications or via API Gateway authorizers. Depending on deployment, Cognito integrates with Lambda for triggers and with IAM for role mappings.

🎯 Commonly Used With

- Amazon API Gateway
- AWS Lambda
- Amazon CloudWatch
- AWS Identity and Access Management
- Amazon S3

🌍 5 Real-World Examples

  • A retail mobile app uses Amazon Cognito User Pools to authenticate customers and issue tokens used to call backend APIs, reducing custom credential management.
  • A financial services portal uses Cognito with SAML federation to integrate with an enterprise identity provider and enforce MFA during sign-in.
  • A healthcare patient portal uses Cognito hosted UI and Lambda triggers to validate user attributes and streamline account verification workflows.
  • An education platform allows students to register using social logins via Cognito federation, simplifying onboarding for mobile and web apps.
  • A government-facing application uses Cognito Identity Pools to grant temporary, least-privilege AWS credentials to client-side components for controlled access to storage.

🎓 AWS Exam Clues

  • Choose Cognito when you need a managed user directory that issues OAuth/OIDC tokens for application authentication.
  • Use Identity Pools when client applications require temporary AWS credentials for direct access to AWS resources.
  • Select Cognito User Pool triggers when you must run custom validation or transformation during authentication flows.
  • Prefer Cognito federation features when integrating social identity providers or SAML/OIDC enterprise IdPs for SSO.
  • Consider regional placement and data residency requirements because user pools and identity pools are configured per region.

📝 Quick Revision

Amazon Cognito is a managed identity service providing user sign-up/sign-in, federation, and JWT issuance for web and mobile apps. Use it for standard OAuth/OIDC/SAML authentication and temporary AWS credential exchange, and consider integration with IAM, Lambda triggers, monitoring, and regional data residency when designing production deployments.

🏷 Keywords

User Pool • Identity Pool • Federation • OAuth 2.0 • OpenID Connect • SAML 2.0 • JWT • Hosted UI • MFA • Lambda Triggers • User attributes • Token revocation