🎉 We are launching a new weekly show: Hot off the Cloud

🎉 We are launching a new weekly show

Cognito Under the Hood

Andreas Wittig – 24 Mar 2021

Have you ever implemented a user database and authentication layer yourself? There are many things to get right: Hashing and salting passwords, multi-factor authentication, brute force attacks, and many more. That’s why I recommend using a production-ready service instead of building authentication yourself. That’s what Amazon Cognito is all about.

Cognito Under the Hood

Let me start with typical use cases for Cognito:

Serverless app with API Gateway

A typical Serverless application uses Cognito User Pools for authentication and authorization.

Serverless app with API Gateway

  1. The client authenticates with the User Pool.
  2. The client sends the identity or access token as a header to the API Gateway.
  3. The API Gateway verifies the token and grants access.
  4. The API Gateway adds information from the identity/access token to the context when invoking a Lambda function.

Obtain temporary AWS credentials

Cognito Identity Pool allows federated identities to access AWS resources by issuing temporary AWS access credentials. Users can use those credentials to interact with AWS APIs directly (e.g., AppSync, S3, DynamoDB, …). That allows clients to access data stores without a backend.

Looking for a new challenge?

  • tecRacer

    Cloud Consultant • AWS Migrations

    tecRacer • Premier AWS Consulting Partner • Germany, Austria, Portugal, and Switzerland
    Assessment Transformation Change Management

    Senior Lead Full Stack Developer

    DEMICON • AWS Advanced Consulting Partner • Remote
    AWS JavaScript/TypeScript Angular React

Obtain temporary AWS credentials

Cloud-native app with ALB

You can add authentication to any cloud-native app that sits behind an ALB. ALBs support authentication/authorization based on Cognito User Pools.

Cloud native app with ALB

We use it to add a layer of security for traditional tools like Jenkins, phpMyAdmin, etc.
You can find a working example here: https://github.com/cfn-modules/docs/tree/master/examples/fargate-alb-auth-cognito

The following video covers:

  • When to use AWS Cognito?
  • Demo: ALB + Cognito User Pool
  • User Pool vs. Identity Pool
  • Pitfall: Backup your most valuable asset!


The following table helps you to decide which option to choose.

User Pool Identity Pool
Built-in User Database ✅ Yes ❌ No
Grant access to AWS resources directly ✅ Yes in combination with an Identity Pool ✅ Yes
Social Login Google, Facebook, Amazon, Apple Google, Facebook, Amazon, Apple
SAML ✅ Yes ✅ Yes
OpenID Connect ✅ Yes ✅ Yes
Hosted UI ✅ Yes ❌ No
Costs $0.0055 per Monthly Active User (MAU) Free

Become a cloudonaut supporter

Andreas Wittig

Andreas Wittig ( Email, Twitter, or LinkedIn )

We launched the cloudonaut blog in 2015. Since then, we have published 360 articles, 49 podcast episodes, and 48 videos. It's all free and means a lot of work in our spare time. We enjoy sharing our AWS knowledge with you.

Please support us

Have you learned something new by reading, listening, or watching our content? With your help, we can spend enough time to keep publishing great content in the future. Learn more

Amount must be a multriply of 5. E.g, 5, 10, 15.

Thanks to Alan Leech, Alex DeBrie, ANTHONY RAITI, Christopher Hipwell, Jaap-Jan Frans, Jason Yorty, Jeff Finley, Jens Gehring, jhoadley, Johannes Grumböck, Johannes Konings, John Culkin, Jonas Mellquist, Juraj Martinka, Kamil Oboril, Ken Snyder, Markus Ellers, Ross Mohan, Ross Mohan, sam onaga, Satyendra Sharma, Shawn Tolidano, Simon Devlin, Thorsten Hoeger, Todd Valentine, Victor Grenu, and all anonymous supporters for your help! We also want to thank all supporters who purchased a cloudonaut t-shirt.