Amazon Cognito
- What it is
- Identity for the users of your application — sign-up, sign-in, and access control for web and mobile apps.
- Scales to millions of users; supports social (Google, Apple, Facebook) and enterprise (SAML, OIDC) identity providers.
- Two halves
- User pools — a user directory. Handles registration, MFA, password policies, and returns JWT tokens. This is authentication.
- Identity pools — exchange a token for temporary AWS credentials so the app can call AWS services directly. This is authorization to AWS.
- Not to be confused with
- AWS Identity and Access Management (IAM) — identities for people and workloads managing your AWS account. Cognito is for your customers.
- AWS IAM Identity Center — workforce single sign-on for employees across AWS accounts.
- The one-line rule
- Customers of your app → Cognito. Employees and AWS operators → IAM / IAM Identity Center.