# Amazon Cognito

> Sign-up, login and passwords for your app, handled by AWS instead of you.

- Level: Intermediate
- Topics: AWS, Security
- URL: https://tidbit.legios.com.ar/amazon-cognito/
- In Spanish: [Amazon Cognito](https://tidbit.legios.com.ar/es/amazon-cognito/)

**Amazon Cognito** manages the users of an application: sign-up, login, password reset, email or phone verification, two-factor authentication, and 'log in with Google' style federation. Your app does not store passwords; Cognito does, and hands your app a signed token that says who the user is.

It has two parts. A **user pool** is the directory of users plus the login machinery: it issues JSON Web Tokens (JWT) that your backend, or Amazon API Gateway directly, can verify. An **identity pool** goes one step further: it exchanges that token for temporary AWS credentials, so a mobile app can upload a photo straight to Amazon S3 under IAM rules, with no server in between.

Example: the app of a gym. Members sign up with their email, confirm with a code, and log in with a password plus an SMS code. The app sends the Cognito token to the API; API Gateway checks the signature and the expiry, and the AWS Lambda function behind it reads the member id from the token. Nobody wrote login code, and the passwords live in a store that AWS hardens.

Why it matters: login is where many security mistakes happen (passwords stored badly, reset flows that leak). Handing it to a managed service is one of the cheapest wins in security. Cognito has a free tier for a first batch of monthly active users, then charges per user.

## An analogy

The membership desk of a club. It issues cards, checks faces, handles lost cards and renewals. Every other door in the club only has to look at the card.

## Keep in mind

- User pools authenticate people and issue JWT tokens; identity pools turn tokens into temporary AWS credentials.
- Supports MFA, social login (Google, Apple, Facebook) and corporate SAML or OIDC through OAuth and SSO standards.
- API Gateway can verify Cognito tokens with zero backend code.
- Your app never touches a password.

## Go deeper

- [What is Amazon Cognito? (official docs)](https://docs.aws.amazon.com/cognito/latest/developerguide/what-is-amazon-cognito.html)
- [Amazon Cognito product page](https://aws.amazon.com/cognito/)

## Related terms

- [Two-factor authentication](https://tidbit.legios.com.ar/two-factor-authentication/): A second proof that you are you, so a stolen password alone is not enough.
- [Google](https://tidbit.legios.com.ar/google/): The search company that gives most products away and makes its money on ads.
- [Token](https://tidbit.legios.com.ar/token/): The small chunk of text a language model actually reads.
- [JSON](https://tidbit.legios.com.ar/json/): The plain-text format programs use to hand each other structured data.
- [Frontend and backend](https://tidbit.legios.com.ar/frontend-and-backend/): The part of an app you see and touch, and the part that works behind it.
- [Amazon API Gateway](https://tidbit.legios.com.ar/amazon-api-gateway/): The front door of your API: it receives requests and passes them to your code.
- [Amazon S3](https://tidbit.legios.com.ar/amazon-s3/): A giant online drawer for files, rented by the gigabyte.
- [IAM](https://tidbit.legios.com.ar/iam/): The rulebook that says who can do what in your AWS account.