Amazon Cognito

What Cognito is

Cognito handles user identity so you don’t have to build an auth server. It comes in two distinct pieces people often confuse. A user pool is a user directory: users sign up and sign in — directly, or federated through Google, Apple, SAML, or OIDC — and the pool issues JSON Web Tokens (an ID token, an access token, and a refresh token). An identity pool does a different job: it exchanges a signed-in identity for temporary AWS credentials so a client can call AWS services like S3 or DynamoDB directly.

For the frontend-plus-auth diagram, the star is the user pool. The frontend authenticates against it to get a token, then sends that token to API Gateway, which consults the same pool to validate it. Design Beaver models Cognito as a regional identity service — not something that sits inside a VPC subnet — and validates as you draw that the authorizer attaches to the right place.

When to use Cognito (and when not to)

Reach for Cognito when you need managed sign-up and sign-in with token issuance and don’t want to run your own auth server, when you want to gate an API Gateway endpoint on a valid user token without writing a custom Lambda authorizer, or when you want social and enterprise federation unified under one directory and token format.

Don’t reach for it for service-to-service authorization between AWS resources — that’s IAM roles and policies, not Cognito. Pure machine-to-machine access with no human user, and no OAuth client-credentials need, is often simpler with an API key or IAM auth. And if you need a full CIAM/SSO product with advanced identity governance beyond Cognito’s scope, evaluate a dedicated product instead.

Variants: user pool vs identity pool

The primary fork isn’t a size or a tier — it’s two different jobs. A user pool authenticates users and issues tokens; an identity pool vends AWS credentials. Feature plans (Lite, Essentials, Plus) are a capability and cost tier applied to a user pool.

Option	What it is
User pooldefault	A user directory that authenticates users and issues JWTs (ID/access/refresh tokens). This is what an API Gateway Cognito authorizer validates, and what a frontend signs into.
Identity pool (federated identities)	Exchanges a signed-in identity (from a user pool or an external IdP) for temporary AWS credentials, so the client can call AWS services (e.g. S3, DynamoDB) directly with scoped permissions.
User pool feature plan — Lite	Low-cost tier with basic sign-in features and the classic hosted UI. Includes the user-pool free tier of monthly active users.
User pool feature plan — Essentials (default)	Default tier for new user pools; adds newer authentication features (choice-based sign-in, email MFA). Includes the user-pool MAU free tier.
User pool feature plan — Plus	Everything in Essentials plus advanced security (threat/compromise detection, activity logging). No free tier on Plus.

Cognito pricing

User pools are billed per monthly active user, by feature plan, and the free tier is the number that matters for early architecture: Lite and Essentials include a monthly free allotment for direct and social sign-ins, while federated SAML/OIDC users get a much smaller one and the Plus plan gets none. Identity pools carry no per-MAU charge of their own — you pay for whatever AWS resources the vended credentials go on to use.

User pools are billed per monthly active user (MAU), by feature plan (Lite/Essentials/Plus). Federated (SAML/OIDC) MAUs and some advanced features are priced separately. Identity pools themselves have no per-MAU charge (you pay for the AWS resources the vended credentials use).

Option	Representative rate
feature-plan-essentials	~$0.015 per MAU above the 10,000 free tier
feature-plan-lite	Lowest per-MAU tier (basic sign-in + classic hosted UI); shares the 10,000-MAU free tier
feature-plan-plus	Highest per-MAU tier — Essentials features plus advanced security; no free tier

Free tier

User pools (Lite or Essentials): 10,000 MAU/month free per account/organization for users signing in directly or via social IdPs
Federated via SAML 2.0 / OIDC: 50 MAU/month free regardless of feature plan
No free tier on the Plus feature plan

Keeping the bill down

Match the feature plan to need — don't put a user pool on Plus (no free tier, advanced-security priced) unless you use its threat-detection/logging
SAML/OIDC-federated users are metered separately with a much smaller free tier — account for that if enterprise SSO is a big share of your users

Pricing is largely uniform but confirm per region. Rates as of 2026-07. Verify at the official pricing page before using for real cost estimates — this list is not kept in sync with AWS pricing changes.

How Cognito connects to other services

The connection that matters here isn’t a data path — it’s an attachment. When a user pool authorizes an API, API Gateway consults the pool to validate the token’s signature and claims before letting a request through, and no request or response payload flows through Cognito itself. Design Beaver draws that as an attachment edge, the same relationship class as an IAM role attachment, so it validates as you draw that the authorizer is wired correctly without treating it like a data-flow hop.

API Gateway
Cognito user pool acts as an API Gateway authorizer (COGNITO_USER_POOLS for REST APIs, or a JWT authorizer for HTTP APIs) — API Gateway validates the token's signature and claims against the user pool before allowing the request through to the backend

Anti-patterns Design Beaver catches

These are the Cognito mistakes that pass a diagram review but leave you with an auth model that doesn’t do what you expect — the ones the validation engine flags as you draw.

Confusing a user pool with an identity pool

Why it breaksThey solve different problems — a user pool authenticates users and issues JWTs (what an API Gateway authorizer checks); an identity pool exchanges an identity for temporary AWS credentials. Wiring the wrong one leads to an auth model that doesn't do what you expect

Do this insteadUse a user pool to sign users in and protect an API via an authorizer; add an identity pool only when the client itself must call AWS services (S3/DynamoDB) directly with scoped credentials

Putting a Cognito authorizer on API Gateway but never having the frontend sign in to the user pool

Why it breaksThe API will reject every request for lack of a valid token — the authorizer is only useful if something authenticates against the pool to obtain a token first

Do this insteadEnsure the frontend authenticates against the same user pool (hosted UI or Auth SDK) and attaches the returned token to its API calls

Gotchas that bite in production

User pool is not the same as identity pool. A user pool authenticates people and issues JWTs; an identity pool hands out temporary AWS credentials. Pick the wrong one and you get an auth model that doesn’t match your intent. Most “log users in and protect my API” cases want a user pool.
An authorizer with no one signing in is dead weight. Attach a Cognito authorizer to API Gateway but never authenticate the frontend against that pool, and every request is rejected for lack of a valid token. The authorizer only helps once something signs in to obtain one.
The pool that issues the token must be the pool that validates it. If the authorizer points at a different user pool than the one your app signs into, validation fails. It’s an easy mismatch to draw and a confusing one to debug.

Frequently asked questions

What's the difference between a Cognito user pool and an identity pool?

A user pool is a user directory — it signs people in (directly or federated via Google/Apple/SAML/OIDC) and issues JSON Web Tokens (JWTs). It's the piece a frontend signs into and the piece an API Gateway authorizer validates. An identity pool does something different — it exchanges a signed-in identity for temporary AWS credentials so a client can call AWS services directly. Wiring the wrong one gives you an auth model that doesn't do what you expect.

How does a Cognito authorizer protect an API Gateway API?

You attach the user pool to the API as a Cognito authorizer (COGNITO_USER_POOLS for REST APIs, or a JWT authorizer for HTTP APIs). The frontend signs into the same pool, gets a token, and sends it in the Authorization header. API Gateway validates the token's signature and claims against the pool before the request reaches the backend. No request or response payload flows through Cognito — it's a control-plane check, which is why Design Beaver draws it as an attachment edge, not a data path.

When should you use Amazon Cognito?

Use Cognito when you need managed user sign-up/sign-in and token issuance without building an auth server, when you want to gate an API Gateway API on a valid user token without writing a custom Lambda authorizer, or when you want federated social/enterprise login unified under one directory. It's the wrong tool for service-to-service authorization between AWS resources — that's IAM roles and policies, not Cognito.

How much does Amazon Cognito cost?

User pools are billed per monthly active user (MAU) by feature plan (Lite, Essentials, Plus). Lite and Essentials include 10,000 free MAU per month for users signing in directly or via social IdPs; SAML/OIDC-federated users get only 50 free MAU; the Plus plan has no free tier. Identity pools have no per-MAU charge of their own — you pay for the AWS resources the vended credentials use. Verify current rates on the official pricing page before estimating a real bill.