Cognito User Pools

What are Cognito User Pools?

A Cognito User Pool is a managed user directory: it stores accounts, handles sign-up/sign-in flows, enforces password policy and MFA, integrates social and SAML identity providers, and issues standard JWTs (ID, access, refresh tokens) your APIs verify. It’s AWS’s answer to Auth0/Okta CIAM — authentication as a checkbox, priced per monthly active user with a free tier generous enough that many products pay nothing for years.

The honest trade-offs

Cognito’s pricing is its headline virtue (fractions of a cent per MAU versus meaningfully higher CIAM competitors) and AWS-native integration its second: API Gateway authorizers, ALB authentication, and IAM credential exchange via Identity Pools all snap in. The costs are developer-experience shaped. The hosted UI is rigid; most teams end up rebuilding auth screens against the API. Some pool settings are immutable after creation (case sensitivity, certain attribute configs), turning small early mistakes into migration projects. And migration out is the classic lock-in: AWS will not export password hashes, so leaving means forced password resets or a slow lazy-migration proxy.

The design decision that matters most

Model your pool attributes and token claims before launch. Custom claims drive authorization across every downstream service; renaming or restructuring them post-launch means coordinating changes across every consumer of your tokens.

What people get wrong

• Confusing User Pools with Identity Pools — User Pools authenticate humans; Identity Pools exchange identities for temporary AWS credentials. Different products, chronically conflated.
• Skipping token verification details: validate signature, issuer, audience, and expiry against the pool’s JWKS; partial verification is a standing vulnerability.
• Ignoring quota ceilings — sign-in request rate limits are real; traffic spikes at launch events need pre-warmed limits or queuing.

Primary source: Amazon Cognito User Pools documentation