AWS Cognito — Authentication & Authorization

AWS Cognito — Authentication & Authorization

Amazon Cognito is AWS’s managed authentication and user management service. It provides user registration, login, social federation, and JWT-based access control for web and mobile applications.

In Azure terms: Cognito = Azure AD B2C + aspects of Microsoft Entra External ID

Two Main Components

1. User Pools

A User Pool is a user directory that provides:

• User registration and sign-in (username/password, email, phone)
• Email/SMS verification and MFA
• Social identity federation (Google, Facebook, Apple, SAML, OIDC)
• Customizable UI (Hosted UI — pre-built sign-in pages)
• JWT tokens: ID token, Access token, Refresh token
• Password policies, account recovery flows
• Lambda triggers for custom auth flows

2. Identity Pools

An Identity Pool (Federated Identities) provides:

• Exchange a User Pool token (or any OIDC/SAML token) for temporary AWS credentials (STS)
• Allows mobile/web apps to access AWS services directly (S3, DynamoDB)
• Supports guest (unauthenticated) access
• Different IAM roles for authenticated vs unauthenticated users

How They Work Together

User signs in → User Pool (JWT tokens)
                    ↓
              Identity Pool → STS assume role
                    ↓
              AWS Credentials (Access Key + Secret + Session)
                    ↓
              App calls S3 / DynamoDB directly

Cognito Tokens

After successful authentication, Cognito returns three JWTs:

Token	Lifetime	Purpose
ID Token	1 hour	Contains user identity claims (email, name, custom attributes)
Access Token	1 hour	Used to authorize API calls; contains groups/scopes
Refresh Token	30 days (default)	Refresh ID and Access tokens without re-login

Hosted UI

Cognito provides a pre-built, customizable login page — no auth UI to build:

https://your-domain.auth.us-east-1.amazoncognito.com/login
  ?client_id=abc123
  &response_type=code
  &scope=openid+email+profile
  &redirect_uri=https://myapp.com/callback

Lambda Triggers

Customize authentication flows with Lambda:

Trigger	When	Use Case
Pre sign-up	Before user created	Block sign-ups from certain domains
Post confirmation	After email verified	Create user record in DynamoDB
Pre authentication	Before login	Check if user is allowed to log in
Post authentication	After successful login	Log sign-in event
Pre token generation	Before JWT issued	Add custom claims to tokens
Custom auth	Custom challenge flow	Passwordless (OTP) login

Cognito with API Gateway

Protect API Gateway endpoints using a Cognito Authorizer:

Client → signs in via Cognito → gets JWT Access Token
Client → calls API Gateway with Authorization: Bearer <token>
API Gateway → validates token with Cognito User Pool
API Gateway → routes request to Lambda (if valid)

Cognito vs Azure AD B2C

Feature	Cognito User Pools	Azure AD B2C
User registration	Yes	Yes
Social login	Google, Facebook, Apple, SAML, OIDC	Google, Facebook, Amazon, GitHub, etc.
Custom UI	Hosted UI (customizable CSS)	Custom policies + page templates
MFA	TOTP, SMS	TOTP, Phone, Email
Tokens	JWT (ID, Access, Refresh)	JWT (ID, Access, Refresh)
User attributes	Preset + custom	Custom via user flows
Lambda integration	Lambda triggers	Custom policies (XML-based)
OIDC/OAuth2	Yes	Yes
Pricing	First 50,000 MAUs free	First 50,000 MAUs free

CLI Examples

# Create a User Pool
aws cognito-idp create-user-pool \
  --pool-name my-user-pool \
  --auto-verified-attributes email \
  --policies PasswordPolicy="{MinimumLength=8,RequireUppercase=true}"

# Create a User Pool Client (app)
aws cognito-idp create-user-pool-client \
  --user-pool-id us-east-1_abc123 \
  --client-name my-web-app \
  --generate-secret

# Sign up a user
aws cognito-idp sign-up \
  --client-id abc123 \
  --username alice@example.com \
  --password MyPassword123!

# Confirm user (admin)
aws cognito-idp admin-confirm-sign-up \
  --user-pool-id us-east-1_abc123 \
  --username alice@example.com

# Admin log in (get tokens)
aws cognito-idp initiate-auth \
  --auth-flow USER_PASSWORD_AUTH \
  --client-id abc123 \
  --auth-parameters USERNAME=alice@example.com,PASSWORD=MyPassword123!

Useful Links

• Cognito Documentation
• Cognito Pricing
• Cognito Hosted UI Setup