Authentication is one of the most critical — and most costly — surfaces to build and maintain in any product. Amazon Cognito is AWS's managed identity platform for web and mobile applications. It acts as a user directory, an authentication server, and an authorisation service for OAuth 2.0 access tokens and AWS credentials. Rather than building and operating custom auth infrastructure, teams can delegate identity management to a service designed specifically for that purpose. Official documentation: https://docs.aws.amazon.com/cognito/latest/developerguide/what-is-amazon-cognito.html
The Two Components of Cognito
Cognito is made up of two distinct components that can be used independently or together: User Pools and Identity Pools.
A User Pool is a managed user directory. It handles user sign-up, sign-in, and access control for your application. Users can authenticate directly through Cognito's hosted UI or through federated third-party providers such as Google, Facebook, or enterprise SAML and OIDC providers. User Pools support multi-factor authentication, customisable workflows via AWS Lambda triggers, and both self-service and administrator-driven account creation.
An Identity Pool (also called a Cognito Federated Identity) is different in purpose. It issues temporary AWS credentials to users — authenticated or anonymous — so that your application can grant those users direct access to AWS resources like S3, DynamoDB, and Lambda. Identity Pools use role-based and attribute-based access control to manage what each user is permitted to do.
- User Pools: user directory, sign-in, MFA, federation via SAML and OIDC
- Identity Pools: issue temporary AWS credentials for resource-level access
- Both components can be used together or independently depending on your architecture
- Supports social providers (Google, Facebook) and enterprise directories (Active Directory via SAML)
Security and Compliance
Cognito is built for production-grade security. It processes over 100 billion authentications per month and is compliant with SOC 1–3, PCI DSS, ISO 27001, and is HIPAA-BAA eligible, as documented in the AWS compliance pages.
Advanced security features include risk-based adaptive authentication, compromised credential monitoring, and IP geo-velocity tracking. When Cognito detects unusual sign-in activity — such as a login attempt from an unexpected location or device — it can prompt users for additional verification or block the request automatically.
For modern authentication patterns, Cognito supports passwordless login via WebAuthn passkeys and SMS/email one-time passwords, reducing reliance on traditional username-and-password flows.
- SOC 1–3, PCI DSS, ISO 27001, HIPAA-BAA eligible
- Adaptive authentication responds to unusual login patterns in real time
- Compromised credential detection prompts password changes automatically
- Passwordless login support via WebAuthn passkeys and OTPs
Why We Use Cognito as Our Standard Identity Layer
Across our products, we use Cognito as the default identity solution. Standardising on a single identity approach reduces the amount of custom authentication code in each product and lowers the long-term security surface area.
Cognito integrates natively with AWS services we already use — including API Gateway, Application Load Balancers, and AppSync — which means token-based access control is enforced at the infrastructure level, not built into application logic.
For teams scaling across multiple environments, Cognito supports multi-tenancy options and consistent identity across development, staging, and production. It works with a broad set of frameworks including React, Next.js, Angular, Vue, Flutter, and mobile SDKs for iOS and Android.
Reference: https://aws.amazon.com/cognito/features/
- Eliminates custom auth surface area across products
- Native integration with API Gateway, ALBs, and AppSync for policy enforcement
- Multi-tenant and multi-environment identity consistency
- SDK support for React, Next.js, Angular, Vue, Flutter, iOS, and Android