AWS Cognito User Pools

Managed auth — sign-up/sign-in, social login, MFA, JWT tokens, and hosted UI.

AWSIntermediate

Why

Cognito handles auth without building it — user pools, social login (Google/Apple/Facebook), MFA, JWT issuance. Free for 50k MAU. Integrates with API Gateway/AppSync.

When

Use for any app needing user auth, especially with social login or enterprise (SAML). Avoid if you need custom auth logic (use Lambda authorizer).

How

1. User pool — aws cognito-idp create-user-pool, attributes, policies 2. App client — aws cognito-idp create-user-pool-client, OAuth flows 3. Hosted UI — Cognito domain, login/signup pages, brandable 4. Social — add identity providers (Google, Facebook, Apple, SAML) 5. MFA — optional/required, TOTP or SMS 6. Triggers — Lambda on PreSignUp, PostConfirmation, CustomMessage 7. Tokens — ID/Access/Refresh JWT, use in API Gateway/AppSync 8. Identity pool — for AWS resource access (S3, DynamoDB) per user

Example

# Create user pool with social login aws cognito-idp create-user-pool --pool-name my-pool \ --policies PasswordPolicy={MinimumLength=8,RequireUppercase=true} \ --schema Name=email,Required=true # Frontend — Amplify Auth import { signIn, signUp, fetchAuthSession } from "aws-amplify/auth"; await signUp({ username: "[email protected]", password, options: { userAttributes: { email } } }); await signIn({ username, password }); const { tokens } = await fetchAuthSession(); // tokens.accessToken.jwtToken → send as Authorization: Bearer # API Gateway — Cognito authorizer aws apigateway create-authorizer \ --rest-api-id api123 \ --name cognito-auth \ --type COGNITO_USER_POOLS \ --provider-arns arn:aws:cognito-idp:us-east-1:123:userpool/us-east-1_abc

Common Problems

⚠Token revocation hard — refresh tokens valid 30d, use token usage for instant revoke
⚠Hosted UI limited customization — for full control, build custom UI with Auth SDK
⚠50 user pools per account — request increase or consolidate pools

Best Practices

✓Use hosted UI for speed — handles OAuth flows, MFA, forgot password for free
✓Set short access token TTL (1h) + long refresh (30d) — balance security and UX
✓Use PreSignUp Lambda — validate email domain, auto-confirm internal users

FAQ

What is AWS Cognito User Pools and what problem does it solve?

Managed auth — sign-up/sign-in, social login, MFA, JWT tokens, and hosted UI. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with AWS Cognito User Pools in 5 minutes?

Two steps to run it: (1) User pool — aws cognito-idp create-user-pool, attributes, policies; (2) App client — aws cognito-idp create-user-pool-client, OAuth flows. Validate on the free tier first, then wire into production.

What is the #1 pitfall with AWS Cognito User Pools?

The most frequent issue is: Token revocation hard — refresh tokens valid 30d, use token usage for instant revoke. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for AWS Cognito User Pools?

Best practices for AWS Cognito User Pools include: Use hosted UI for speed — handles OAuth flows, MFA, forgot password for free; Set short access token TTL (1h) + long refresh (30d) — balance security and UX; Use PreSignUp Lambda — validate email domain, auto-confirm internal users. The first one — "Use hosted UI for speed — handles OAuth flows, MFA, forgot password for free" — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with AWS Cognito User Pools?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most AWS Cognito User Pools options offer a free tier — validate within free quota before scaling.