AWS Cognito

Amazon Cognito handles sign-up, sign-in, and access control for the users of your web and mobile apps. Developers skip the work of building password storage, email verification, and token handling from scratch. Cognito manages those pieces in a secure, scalable way.

Think of a concert venue. A ticket desk checks who you are and hands you a wristband. Guards at each area look at the wristband and let you through. Cognito acts as the ticket desk, and the wristband is a token your app and AWS services accept.

Authentication and Authorization

  • Authentication proves who a person is, usually with a password, a code, or a fingerprint.
  • Authorization decides what that person may do after sign-in.

Cognito covers both through two main components.

User Pools

A user pool is a user directory. It stores profiles and handles the sign-in process. After a successful login, the pool returns tokens in the JSON Web Token (JWT) format.

What a User Pool Offers

  • Sign-up and sign-in with email, phone number, or username
  • Email and SMS verification codes
  • Password rules and account recovery
  • Multi-factor authentication (MFA)
  • Social sign-in with providers such as Google, Facebook, and Apple
  • Enterprise sign-in through SAML and OpenID Connect
  • A hosted sign-in page you can brand with your own logo

The Three Tokens

  • ID token: carries user details such as name and email.
  • Access token: proves permission to call protected APIs.
  • Refresh token: lets the app obtain new tokens without asking the user to sign in again.

Identity Pools

An identity pool exchanges a sign-in token for temporary AWS credentials. A mobile app uses those credentials to upload a photo directly to an S3 bucket. Each user receives access only to the resources that the attached IAM role allows.

User Pools and Identity Pools Compared

+----------------+-----------------------+---------------------------+
|                | User Pool             | Identity Pool             |
+----------------+-----------------------+---------------------------+
| Main job       | Sign in users         | Give AWS credentials      |
| Output         | JWT tokens            | Temporary AWS keys        |
| Answers        | Who are you?          | What AWS resources can    |
|                |                       | you use?                  |
+----------------+-----------------------+---------------------------+

Sign-In Flow With an API

 User opens app
      |
      v
 Sign-in page (Cognito)
      |
      v
 Cognito checks password and MFA
      |
      v
 Cognito returns tokens to the app
      |
      v
 App calls API Gateway with the access token
      |
      v
 API Gateway validates the token with the user pool
      |
      v
 Backend returns data

Flow With Direct AWS Access

 User signs in (User Pool)
      |
      v
 App sends ID token to Identity Pool
      |
      v
 Identity Pool returns temporary credentials
      |
      v
 App uploads file to S3 under /users/USER-ID/

Customizing the Process With Lambda Triggers

Lambda triggers run your code at points in the user journey. A pre sign-up trigger can reject addresses from blocked domains. A post confirmation trigger can create a profile row in DynamoDB. A pre token generation trigger can add custom claims, such as a subscription level.

Groups and Roles

Place users in groups such as Admins and Customers. Each group can map to an IAM role. An admin dashboard checks the group claim in the token before showing management screens.

Example: A Fitness App

  1. Create a user pool that allows sign-up with email.
  2. Turn on MFA as optional.
  3. Add Google as a social sign-in option.
  4. Create an app client for the mobile app.
  5. Build an identity pool that lets signed-in users write to their own S3 folder.
  6. Connect API Gateway to the user pool for protected data calls.

Security Features

  • Adaptive authentication detects risky sign-in attempts.
  • Compromised credential checks flag leaked passwords.
  • Token lifetimes limit how long a stolen token stays useful.
  • AWS WAF can protect the hosted sign-in endpoints.

Privacy Responsibilities

User directories hold personal data. Collect only the attributes your app truly needs. Publish a clear privacy policy. Offer users a way to delete their accounts, since many privacy laws require it.

Best Practices

  • Enable MFA for sensitive apps.
  • Use short access token lifetimes.
  • Validate tokens on the server side for every request.
  • Keep client secrets out of mobile app code.
  • Test the account recovery process with real scenarios.
Previous lesson
Back to course
Next lesson