All Services

Security & IAM

Amazon Cognito

Amazon Cognito provides user pools for application sign-up, sign-in, federation, and OAuth or OIDC tokens, plus identity pools that exchange authenticated or guest identities for temporary AWS credentials.

Explore pricing models, common use cases, infrastructure support, and the AWS services that commonly work with Amazon Cognito.

Amazon Cognito pricing and cost programs

Pricing model: Identity activity and user usage

On-Demand
Available
Reserved Instances or reserved capacity
Not applicable
Savings Plans
Not applicable
Spot
Not applicable

Billing dimensions: Monthly active users · Machine-to-machine token requests · Advanced security features · SMS or email delivery

Programs and modes: User pools · Identity pools · Lite, Essentials, and Plus tiers

Feature tier, active-user type, and messaging integrations affect charges.

Free Tier: Available — verify current offers

Pricing reviewed 2026-07-25. Reviewed against the linked official AWS pricing page. Recheck regional rates and program terms before purchase.

Official AWS pricing

Official AWS sources reviewed 2026-07-21.

Why implement Amazon Cognito?

  • Provides managed consumer identity directories, authentication flows, federation, token issuance, account recovery, and security features for web and mobile applications.
  • Scales public user populations without teams operating password databases and authorization servers.
  • Can issue temporary, scoped AWS credentials through identity pools for approved direct access to AWS resources.

How to implement Amazon Cognito

  1. Choose a user pool for application authentication and use an identity pool only when clients need temporary AWS credentials; define account, attribute, verification, recovery, privacy, and deletion policy first.
  2. Configure a custom domain, federated providers, app clients without a secret for public clients, authorization-code flow with PKCE, passkeys or MFA, secure redirect URIs, WAF, and Lambda triggers only where justified.
  3. Validate issuer, audience or client ID, signature, token use, expiry, and scopes in every backend; map identity-pool roles narrowly and test sign-up abuse, recovery, revocation, offboarding, and account deletion.

Amazon Cognito best practices

  • Prefer phishing-resistant passkeys or MFA, short-lived tokens, PKCE, exact redirect URIs, and server-side token validation; never trust decoded token claims without verification.
  • Protect public sign-up and recovery from enumeration, bots, SMS pumping, and account takeover with WAF, adaptive security where available, budgets, rate controls, and monitored delivery failures.
  • Keep user-pool and identity-pool responsibilities distinct, minimize stored attributes and scopes, restrict trigger roles and temporary AWS credentials, and test user export or deletion obligations.

Amazon Cognito use cases and server impact

  • Consumer web and mobile authentication
  • Federation with social or enterprise identity providers
  • Temporary AWS access for authorized app clients

Replaces much customer identity-directory and token-service infrastructure, while application authorization, token validation, abuse defense, user support, and privacy compliance remain yours.

Official implementation resources

Commonly paired AWS services

Architecture patterns using this service

  • Build a secure serverless API on AWS — Authenticate users with Amazon Cognito, validate requests at Amazon API Gateway, run business logic in AWS Lambda, and store application data in Amazon DynamoDB.

Planning guides that use Amazon Cognito