What is Amazon Cognito? - Amazon Cognito
Features of Amazon CognitoGetting started with Amazon CognitoRegional availabilityPricing for Amazon Cognito
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

What is Amazon Cognito?

Amazon Cognito provides authentication, authorization, and user management for your web and mobile apps. Your users can sign in directly with a user name and password, or through a third party such as Facebook, Amazon, Google or Apple.

The two main components of Amazon Cognito are user pools and identity pools. User pools are user directories that provide sign-up and sign-in options for your app users. Identity pools enable you to grant your users access to other Amazon services. You can use identity pools and user pools separately or together.

An Amazon Cognito user pool and identity pool used together

See the diagram for a common Amazon Cognito scenario. Here the goal is to authenticate your user, and then grant your user access to another Amazon service.

  1. In the first step your app user signs in through a user pool and receives user pool tokens after a successful authentication.

  2. Next, your app exchanges the user pool tokens for Amazon credentials through an identity pool.

  3. Finally, your app user can then use those Amazon credentials to access other Amazon services such as Amazon S3 or DynamoDB.

Amazon Cognito overview

For more examples using identity pools and user pools, see Common Amazon Cognito scenarios.

Amazon Cognito is compliant with SOC 1-3, PCI DSS, ISO 27001, and is HIPAA-BAA eligible. For more information, see Amazon services in scope. See also Regional data considerations.

Topics

Features of Amazon Cognito

User pools

A user pool is a user directory in Amazon Cognito. With a user pool, your users can sign in to your web or mobile app through Amazon Cognito, or federate through a third-party identity provider (IdP). Whether your users sign in directly or through a third party, all members of the user pool have a directory profile that you can access through an SDK.

User pools provide:

  • Sign-up and sign-in services.

  • A built-in, customizable web UI to sign in users.

  • Social sign-in with Facebook, Google, Login with Amazon, and Sign in with Apple, and through SAML and OIDC identity providers from your user pool.

  • User directory management and user profiles.

  • Security features such as multi-factor authentication (MFA), checks for compromised credentials, account takeover protection, and phone and email verification.

  • Customized workflows and user migration through Amazon Lambda triggers.

For more information about user pools, see Getting started with user pools and the Amazon Cognito user pools API reference.

Identity pools

With an identity pool, your users can obtain temporary Amazon credentials to access Amazon services, such as Amazon S3 and DynamoDB. Identity pools support anonymous guest users, as well as the following identity providers that you can use to authenticate users for identity pools:

  • Amazon Cognito user pools

  • Social sign-in with Facebook, Google, Login with Amazon, and Sign in with Apple

  • OpenID Connect (OIDC) providers

  • SAML identity providers

  • Developer authenticated identities

To save user profile information, your identity pool needs to be integrated with a user pool.

For more information about identity pools, see Getting started with Amazon Cognito identity pools (federated identities) and the Amazon Cognito identity pools API reference.

Getting started with Amazon Cognito

For a guide to top tasks and where to start, see Getting started with Amazon Cognito.

For videos, articles, documentation, and sample apps, see Amazon Cognito developer resources.

To use Amazon Cognito, you need an Amazon account. For more information, see Using the Amazon Cognito console.

Regional availability

Amazon Cognito is available in multiple Amazon Regions worldwide. In each Region, Amazon Cognito is distributed across multiple Availability Zones. These Availability Zones are physically isolated from each other, but are united by private, low-latency, high-throughput, and highly redundant network connections. These Availability Zones enable Amazon to provide services, including Amazon Cognito, with very high levels of availability and redundancy, while also minimizing latency.

For a list of all the Regions where Amazon Cognito is currently available, see Amazon regions and endpoints in the Amazon Web Services General Reference. To learn more about the number of Availability Zones that are available in each Region, see Amazon global infrastructure.

Pricing for Amazon Cognito

For information about Amazon Cognito pricing, see Amazon Cognito pricing.