Amazon Cognito
Sign-up, login and passwords for your app, handled by AWS instead of you.
Amazon Cognito manages the users of an application: sign-up, login, password reset, email or phone verification, two-factor authentication, and 'log in with Google' style federation. Your app does not store passwords; Cognito does, and hands your app a signed token that says who the user is.
It has two parts. A user pool is the directory of users plus the login machinery: it issues JSON Web Tokens (JWT) that your backend, or Amazon API Gateway directly, can verify. An identity pool goes one step further: it exchanges that token for temporary AWS credentials, so a mobile app can upload a photo straight to Amazon S3 under IAM rules, with no server in between.
Example: the app of a gym. Members sign up with their email, confirm with a code, and log in with a password plus an SMS code. The app sends the Cognito token to the API; API Gateway checks the signature and the expiry, and the AWS Lambda function behind it reads the member id from the token. Nobody wrote login code, and the passwords live in a store that AWS hardens.
Why it matters: login is where many security mistakes happen (passwords stored badly, reset flows that leak). Handing it to a managed service is one of the cheapest wins in security. Cognito has a free tier for a first batch of monthly active users, then charges per user.
Keep in mind
- User pools authenticate people and issue JWT tokens; identity pools turn tokens into temporary AWS credentials.
- Supports MFA, social login (Google, Apple, Facebook) and corporate SAML or OIDC through OAuth and SSO standards.
- API Gateway can verify Cognito tokens with zero backend code.
- Your app never touches a password.
