Amazon Cognito
Sign-in for app users
Sign-up/sign-in for end users (email, Google, Facebook, SAML), issuing JWT tokens to call APIs.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?No
- Managed by AWS
- In examsSAA · DVA
Think of it asLike the membership card desk for a store's customers.
Where does Cognito fit?
Calls Cognito
API Gatewayverifies tokens- Usersigns in
CognitoA real example, step by step
- You're building a photo-sharing app that needs sign-up, sign-in, password reset and “Sign in with Google”.
- You create a Cognito user pool, enable MFA and the Google button; a ready-made sign-in page comes with it.
- After signing in, users receive JWT tokens, and API Gateway checks the token before allowing API calls.
- An identity pool exchanges that token for temporary AWS permissions so the app uploads photos straight to the user's own folder in S3.
- You never store passwords yourself or build the verification-code flow.
When to use it
✓ Use it when
Web/mobile apps that need user accounts.
✗ Avoid it when
Employees signing in to AWS → IAM Identity Center.
Common uses
- Sign-up / sign-in for web and mobile apps
- Sign in with Google, Facebook, Apple or enterprise SAML
- Grant temporary credentials so apps can access S3 directly (identity pools)
Cognito, IAM Identity Center or IAM?
| Cognito |  IAM Identity Center |  IAM | |
|---|---|---|---|
| For | End users of an app | Employees accessing AWS accounts | Permissions inside an AWS account |
| Sign in with | Email, social, SAML/OIDC | Company directory (SSO) | Passwords, access keys, roles |
| Scale | Millions of users | Company employees | Administrators and services |
| Cost | Per monthly active user | Free | Free |
What does it cost?
- Pricing model: Per MAU (monthly active users), with prices varying by Lite / Essentials / Plus tier; users signing in via SAML/OIDC are billed separately.
- Free tier: First 10,000 MAU free each month (Lite/Essentials tiers).
Choosing a higher tier than needed; SMS OTP codes are billed separately; SAML-federated users cost more.
User pool = sign-up/sign-in, returns tokens; identity pool = exchanges an identity for temporary AWS credentials. A mobile app needs S3/DynamoDB without embedded access keys → identity pool. Cognito works as an API Gateway authorizer.
Try real exam questions
1A company designs a mobile app for its customers to upload photos to a website. The app needs a secure login with multi-factor authentication (MFA). The company wants to limit the initial build time and the maintenance of the solution. Which solution should a solutions architect recommend to meet these requirements?
- AUse Amazon Cognito user pools with SMS-based MFA.
- BEdit IAM policies to require MFA for all users.
- CFederate IAM against the corporate Active Directory that requires MFA.
- DUse Amazon API Gateway and require server-side encryption (SSE) for photos.
Show answer
Correct answer: A
A Cognito user pool provides sign-up, sign-in and SMS-based MFA for app users out of the box, so it's quick to build and easy to maintain. IAM is for AWS administrators, not for an app's customers.
2A company wants to restrict access to the content of its web application. The company needs to protect the content by using authorization techniques that are available on AWS. The company also wants to implement a serverless architecture for authorization and authentication that has low login latency. The solution must integrate with the web application and serve web content globally. The application currently has a small user base, but the company expects the application's user base to increase. Which solution will meet these requirements?
- AConfigure Amazon Cognito for authentication. Implement Lambda@Edge for authorization. Configure Amazon CloudFront to serve the web application globally.
- BConfigure AWS Directory Service for Microsoft Active Directory for authentication. Implement AWS Lambda for authorization. Use an Application Load Balancer to serve the web application globally.
- CConfigure Amazon Cognito for authentication. Implement AWS Lambda for authorization. Use Amazon S3 Transfer Acceleration to serve the web application globally.
- DConfigure AWS Directory Service for Microsoft Active Directory for authentication. Implement Lambda@Edge for authorization. Use AWS Elastic Beanstalk to serve the web application globally.
Show answer
Correct answer: A
Cognito handles user authentication, Lambda@Edge checks authorization right at the edge, and CloudFront delivers content worldwide: all serverless, with low latency.
Frequently asked questions
What is the difference between a user pool and an identity pool?
A user pool is a user directory: sign-up, sign-in, MFA, social sign-in with Google or Facebook, returning JWT tokens. An identity pool exchanges an identity (including guests) for temporary AWS credentials to call services such as S3 or DynamoDB directly.
How is Cognito priced?
Mainly by monthly active users (MAUs) in the user pool, with different rates per feature tier (Lite, Essentials, Plus). Some features, such as SAML or OIDC federation and advanced security, cost extra.
What do AWS exams ask about Cognito?
Telling user pools and identity pools apart, using Cognito as an authorizer for API Gateway, social sign-in, and giving mobile apps temporary AWS permissions without embedding access keys.