Amazon Cognito

An authentication service that manages user registration and login for apps.

Back to glossary Go to related practice questions

In one sentence

An authentication service that manages user registration and login for apps.

Overview

A service that handles user registration, login, and authentication token issuance. Used as the authentication foundation for web and mobile apps.

Common use cases

Login functionality for a learning site
JWT authentication for API Gateway
Protecting per-user learning history

CLF-C02 exam points

Used for user authentication
Has User Pools and Identity Pools
Supports MFA and external IdP integration

SAA-C03 exam points

Integrates with API Gateway JWT Authorizer
User Pools are for authentication; Identity Pools are for AWS authorization
Use userId from the token to control data access

Practical Use

Amazon Cognito is a fully managed service for adding **user authentication and authorization infrastructure** to web and mobile applications. It has two main components with different roles. **User Pool** is an authentication directory that manages user sign-up, sign-in, password reset, and MFA. After successful authentication, it issues JWTs (ID token / access token / refresh token) and returns them to the client. When combined with API Gateway's JWT Authorizer, authentication checks for requests reaching Lambda can be performed at the gate stage. **Identity Pool (formerly: Federated Identities)** issues temporary AWS credentials (essentially IAM role credentials) to authenticated users (authenticated via Cognito User Pool or external IdPs such as Google or Facebook). It is used in configurations where users access S3 buckets or DynamoDB tables directly (e.g., direct SDK calls from a Mobile SDK). A critical implementation note: when verifying ownership of personal data returned from an API, use the JWT claim `sub` (subject). The `userId` included in the request body or URL path can be tampered with and must not be used as a trusted identifier. Only claims verified by a Lambda Authorizer or JWT Authorizer must be used in the backend's authorization logic — this design is essential. CLF-C02 asks about Cognito as "the service used for application user authentication" or "the managed service that handles user login". SAA-C03 covers the distinction between User Pool and Identity Pool, JWT Authorizer integration with API Gateway, and the design of external IdP federation.

Official Documentation

Cost notes

Charged based on MAU and advanced features
Out of scope for the MVP since login is not built

Security notes

Do not trust user IDs taken from the request body
Verify identity using JWT-verified claims

Related services

Amazon API Gateway

The API entry point that invokes Lambda from the frontend.

AWS Identity and Access Management

Core security service that controls who is allowed to perform which actions on AWS.

AWS Lambda

Runs code only when needed, without launching servers.

Related architecture diagrams

SERVERLESS / API / BASIC