# AWS Cognito

> Amazon Cognito provides user sign-up, sign-in and access control for web and mobile apps, with user pools and identity pools.

- Source: https://www.itwonderlab.com/aws-cognito/
- Published: 2026-03-07
- Updated: 2026-03-07
- Author: Javier Ruiz Jiménez (https://www.javierruizjimenez.com/)
- Site: IT Wonder Lab (https://www.itwonderlab.com/)

---

**Amazon Cognito** adds authentication to applications without running your own identity system.

- **User pools** are user directories: registration, sign-in, password policies, MFA, social login (Google, Apple) and SAML or OIDC federation. They issue JWT tokens, which [API Gateway](https://www.itwonderlab.com/aws-api-gateway/) and load balancers can validate.
- **Identity pools** exchange a token for temporary AWS credentials so a mobile app can, for example, upload to [S3](https://www.itwonderlab.com/aws-s3/) with limited [IAM](https://www.itwonderlab.com/aws-iam/) permissions.

Pricing is per monthly active user, with a free tier.

### With Terraform

Resources: `aws_cognito_user_pool`, `aws_cognito_user_pool_client`, `aws_cognito_user_pool_domain` and `aws_cognito_identity_pool`. A JWT authorizer for an HTTP API is shown in the [Lambda and API Gateway tutorial](https://www.itwonderlab.com/terraform-aws-lambda-api-gateway/).