Implementing User Authentication with Amazon Cognito - Designing User Pools and Identity Pools

Overview of Cognito

Cognito is a service that provides authentication, authorization, and user management for web and mobile applications, and the Essentials tier, the default for new user pools, includes a free tier of up to 10,000 MAU (monthly active users) per month per account or AWS organization (as listed on the official pricing page, as of August 2026). The free tier is not per user pool, so splitting pools does not increase it. It applies to two tiers, Lite and Essentials, and the higher Plus tier has no free tier. User Pools serve as user directories, managing sign-up, sign-in, and MFA. Identity Pools issue temporary AWS credentials to authenticated users, enabling direct access to AWS resources. Social login (Google, Facebook, Apple, Amazon) and SAML/OIDC federation are supported, and you can add an external IdP by registering the provider in the management console and assigning it to an app client. However, attribute mapping, scope adjustment, and verification of sign-out behavior each require individual design.

Choosing Between User Pools and Identity Pools

User Pools issue JWT tokens (ID tokens, access tokens, with configurable expiration from 5 minutes to 1 day) that are validated by API Gateway authorizers. Identity Pools receive User Pool tokens and return temporary AWS credentials based on IAM roles. When uploading files to S3 from the frontend, you call the S3 SDK directly using credentials obtained from the Identity Pool. Lambda triggers enable implementing email domain restrictions in Pre Sign-up, sending welcome emails in Post Confirmation, and adding custom claims in Pre Token Generation. The principle for choosing between them is clear: if you only need backend API authentication, User Pool JWTs are sufficient; if clients need to call AWS resources directly (S3, DynamoDB, AppSync), combine with Identity Pools.

Threat Protection and Managed Login

Cognito's threat protection provides risk-based adaptive authentication that dynamically determines MFA requirements based on risk level (device, IP address, login history). It also includes compromised credential detection, logging and analysis of threat profiles and user activity, and their export, and these can be used only in the Plus feature plan (formerly called advanced security features; as listed on the official pricing page, as of August 2026). You can operate it so that logins from usual devices skip MFA, while access from unknown devices or unusual IPs requires MFA. You can also implement CAPTCHA verification and custom MFA by using Lambda triggers in custom authentication flows. For the login screen, managed login is the current offering, and you can use branding edits with the visual editor in Essentials and Plus, and CSS customization in all plans, including Lite. The classic hosted UI can still be used, but the visual editor applies to managed login pages. Adding custom claims to ID tokens can be implemented with the Pre Token Generation trigger, and the ability to customize access token scopes and claims at runtime can be used in Essentials and Plus.

Design Best Practices and Pitfalls

Here are three pitfalls that are easy to fall into when adopting Cognito. First, User Pools have attributes that cannot be changed after creation (username format, required attributes), so determine the schema carefully at the design stage. Changing to "use email as username" later requires recreating the User Pool and migrating users. Second, if you forget to configure a custom domain, the default URL issued by Cognito (amazoncognito.com) gives users a sense of distrust from a phishing prevention perspective. Configuring a custom domain with an ACM certificate is recommended. Third, pay attention to the response time of Lambda triggers. Cognito invokes Lambda functions synchronously, and the function must respond within 5 seconds (Custom sender triggers, which do not wait for a response, are the exception). This timeout is fixed at 5 seconds on the Cognito side and cannot be changed by extending the timeout setting on the Lambda function side (as listed in the official documentation, as of August 2026). If Pre Token Generation calls an external API and latency exceeds the limit, token issuance fails and users cannot log in. Either put a cache layer in front of external calls or move them out of the trigger as asynchronous processing, and design the trigger so that it performs only processing that reliably fits within 5 seconds.

Comparison with Auth0 and Firebase Authentication

Cognito's competitors include Auth0 and Firebase Authentication. Auth0 excels in admin console usability and documentation quality, with rich presets for complex authentication flows (Organization-based multi-tenancy, step-up authentication). Because pricing for each service varies by plan structure and add-ons, the reliable approach is to decide your expected MAU and required features in advance and to estimate on each official pricing page. Firebase Authentication integrates naturally with Google's ecosystem (Firestore, Cloud Functions), but in AWS-centric architectures requires additional implementation for IAM role integration. Cognito's greatest strength is native integration with AWS services (API Gateway authorizers, Identity Pool IAM role mapping, direct AppSync connection), providing minimal friction when building AWS-centric backends. If you want to build the authentication screen in detail, begin by checking whether the managed login visual editor (Essentials and Plus) and CSS customization (all plans) can meet your requirements; if they cannot, building your own authentication screen with Amplify UI components is also an option.

Cognito Pricing

(As of August 2026, N. Virginia us-east-1 and Tokyo ap-northeast-1) Cognito has six billing dimensions. They are user pool MAU (by feature plan), MAU for SAML 2.0 / OIDC federation users, token requests for machine-to-machine (M2M) authorization, API request rate increases, multi-Region replication, and the legacy advanced security features (ASF) add-on. Identity Pool authentication and unique identifier issuance are free, and there is no charge for the number of M2M app clients registered. User pool feature plans have a three-tier structure of Lite, Essentials, and Plus, and the default for new user pools is Essentials. Unit prices are per MAU (the Price List unit is CognitoUserPoolsMAU): Essentials is 0.015 USD/MAU and Plus is 0.020 USD/MAU, the same price in the two Regions. Lite uses a four-level tiered structure, and all tier boundaries are explicitly listed in the tier table on the official pricing page and in the public Price List data. The first 90,000 billable MAU (up to 100,000 total MAU including the 10,000 free tier) cost 0.0055 USD/MAU, the next 900,000 MAU (up to 1,000,000 total MAU) cost 0.0046 USD/MAU, the next 9,000,000 MAU (up to 10,000,000 total MAU) cost 0.00325 USD/MAU, and usage beyond that costs 0.0025 USD/MAU. SAML 2.0 / OIDC federation users are free up to 50 MAU regardless of plan structure, and usage beyond that costs 0.015 USD/MAU.

Each add-on has a different unit. M2M authorization is billed per successful token response: the first 250,000 requests cost 0.00225 USD per token request (the unit is CognitoUserPools-M2MTokens), the next 4,750,000 requests (up to 5,000,000 requests) cost 0.0015 USD, and requests beyond 5,000,000 cost 0.001125 USD. When multi-Region replication is also used, the first tier is 0.002925 USD. API request rate increases are billed monthly per 1 RPS of increase above the default quota, and each API category is billed separately (the unit is CognitoUserPoolsRPSMo, with a minimum period of 1 day). If applied for the entire month, the price is 20.00 USD per 1 RPS of increase; if applied for only part of the month, 45.00 USD per 1 RPS of increase is prorated by the number of days. The legacy ASF add-on uses a five-level tiered structure per MAU: the first 50,000 MAU cost 0.05 USD/MAU, the next 50,000 MAU cost 0.035 USD/MAU, the next 900,000 MAU (up to 1,000,000 MAU) cost 0.02 USD/MAU, the next 9,000,000 MAU (up to 10,000,000 MAU) cost 0.015 USD/MAU, and usage beyond that costs 0.01 USD/MAU. ASF has no free tier, and it differs from Essentials and Plus in that all MAU are billable without deducting the 10,000 MAU free tier. There are five points regarding the free tier and exceptions. First, the 10,000 MAU free tier for direct sign-in or sign-in through a social IdP applies only to Lite and Essentials, and Plus has no free tier. It does not expire after the 12 months of the AWS Free Tier and applies indefinitely to both existing and new customers, but it does not apply in AWS GovCloud (US). Second, existing pools created on or before November 22, 2024 keep the free tier for the first 50,000 MAU. Third, ASF is not offered to new customers and is an add-on that customers already using ASF can continue to use at the legacy price (according to AWS, Plus saves up to 60% compared with ASF, and ASF cannot be used in AWS GovCloud (US-West)). Fourth, M2M token requests have no free tier. Fifth, SMS messages sent for MFA, sign-up, password recovery, and phone number verification incur separate Amazon SNS charges, and email messages sent for sign-up, password recovery, and email address verification incur separate Amazon SES charges. As a calculation example, 950,000 MAU on Essentials comes to (950,000 - 10,000) × 0.015 USD = 14,100 USD per month, and the same scale on Plus, which has no free tier, comes to 950,000 × 0.020 USD = 19,000 USD per month. With MAU-based billing, registered users who do not log in do not affect costs.

Summary

Cognito is a service that provides user authentication through User Pools and AWS resource access through Identity Pools. It integrates with an external IdP through social login and SAML/OIDC federation, and in the Plus feature plan, threat protection can dynamically apply risk-based MFA. Native integration with AWS services is its greatest strength, and careful User Pool schema design at the initial stage is key to long-term operation.