AWS Cognito

· 1 min read · AWS

Amazon Cognito adds authentication to applications without running your own identity system.

  • User pools are user directories: registration, sign-in, password policies, MFA, social login (Google, Apple) and SAML or OIDC federation. They issue JWT tokens, which API Gateway and load balancers can validate.
  • Identity pools exchange a token for temporary AWS credentials so a mobile app can, for example, upload to S3 with limited IAM permissions.

Pricing is per monthly active user, with a free tier.

With Terraform #

Resources: aws_cognito_user_pool, aws_cognito_user_pool_client, aws_cognito_user_pool_domain and aws_cognito_identity_pool. A JWT authorizer for an HTTP API is shown in the Lambda and API Gateway tutorial.

More tutorials that use Cognito

#AWS #Security