Amazon Cognito Popular2014年〜
A service that provides authentication, authorization, and user management for web and mobile applications
What It Does
Amazon Cognito is a service that adds user sign-up, sign-in, and access control capabilities to web and mobile applications. User pools manage user registration and authentication, while identity pools grant authenticated users access permissions to AWS resources. It also supports social login with Google, Facebook, Apple, and others, as well as integration with SAML-based enterprise identity providers.
Use Cases
Cognito is used to implement email and password sign-up/sign-in functionality in web applications, and to add social login with Google accounts. It is also used for access control implementations that allow only authenticated users to access S3 buckets or API Gateway endpoints.
Everyday Analogy
Think of it like the entrance gate at a theme park. Visitors (users) either show their annual pass at the gate (sign in as an existing user) or purchase a new ticket (sign up). Once through the gate, the type of ticket determines which areas they can access (authorization). Cognito serves as this entrance gate, managing who can access which resources.
What Is Cognito?
Amazon Cognito is a service that manages authentication (identity verification) and authorization (granting access permissions) for applications. It provides features like user registration, login, password reset, and multi-factor authentication (MFA) without having to build them yourself. It is a fully managed service that scales to millions of users, with security best practices built in.
User Pools and Identity Pools
Cognito has two main components. User pools are user directories that manage user registration and authentication. They provide sign-up, sign-in, password reset, and MFA features, issuing JWT tokens upon successful authentication. Identity pools grant authenticated users temporary AWS credentials, enabling direct access to AWS resources like S3 and DynamoDB.
Social Login and Enterprise Identity Federation
Cognito supports federation with external identity providers. By configuring social identity providers such as Google, Facebook, Apple, and Amazon, users can sign in with their existing accounts. For enterprises, it supports SAML 2.0 and OpenID Connect (OIDC), enabling SSO (Single Sign-On) with enterprise identity providers like Active Directory and Okta. For practical know-how on social login and enterprise identity federation, specialized books on Amazon are also a great resource.
Getting Started
To get started with Cognito, create a user pool in the Cognito console. Configure sign-in methods (email, phone number, username) and password policies, then create an app client. For frontend applications, using the Amplify library lets you integrate sign-up and sign-in UI with just a few lines of code. The free tier includes up to 50,000 monthly active users at no charge.
Things to Watch Out For
- Some user pool settings (sign-in attributes, MFA types, etc.) cannot be changed after creation. Thoroughly review your requirements before creating one
- The free tier covers up to 50,000 MAU (monthly active users). Social login and SAML federation users have a separate pricing structure
- JWT token expiration defaults to 1 hour. Implement token refresh logic on the application side
