- Home
- Identity and Access Management Software
- Amazon Cognito
Amazon Cognito
What it is
Amazon Cognito provides sign-up, sign-in, access control, and brokered AWS service access for web and mobile applications. It supports passwordless login by email, SMS, or WebAuthn passkeys, as well as MFA and risk-based adaptive authentication. Social identity options include Apple, Facebook, Google, and Amazon, while enterprise connections can use SAML or OIDC. Cognito integrates with AWS Amplify, Lambda, AWS WAF, AppSync, Application Load Balancers, API Gateway, and Amazon Verified Permissions. SDKs are listed for Java, C++, PHP, Python, Golang, Ruby, .NET, and JavaScript. AWS describes uses including customer identity, B2B multi-tenancy, machine-to-machine authorization, and authentication for microservices and workloads; identity stores can scale to millions of users. Monitoring and event-log streaming are supported. AWS states that Cognito is HIPAA eligible and compliant with PCI DSS, SOC, and several ISO standards. A free plan is available, but not in AWS GovCloud (US) Regions; machine-to-machine token requests have no free tier. Some advanced threat protections require Plus.
For and against
For
- Supports passwordless sign-in and MFA
- Offers social and enterprise federation
- SDKs are listed for eight languages
- Free tier available for eligible usage
Against
- No free tier in AWS GovCloud (US) Regions
- Machine-to-machine token requests have no free tier
- Some advanced protections require Plus
- SMS and email charges are separate
The verdict
Cognito covers several application identity patterns and offers a range of sign-in and federation options. Review the tier limits and separate messaging charges to understand which usage is covered by the free tier.
Who it suits
Cognito may suit developers building web or mobile applications that need user sign-in, access control, or AWS service access. It also lists options for social and enterprise identity providers and several AWS integrations.
Plans and prices
Essentials
10,000 MAUs free monthly for eligible direct or social sign-ins; 50 MAUs free monthly for SAML/OIDC federation; usage-based rates above free tier; SMS and email charges separate
Read 2 Oct 2026 · aws.amazon.com
Lite
10,000 MAUs free monthly for eligible direct or social sign-ins; usage-based rates above free tier; SMS and email charges separate
Read 2 Oct 2026 · aws.amazon.com
Plus
No free tier for direct or social sign-ins; usage-based rates; SMS and email charges separate
Read 2 Oct 2026 · aws.amazon.com
On the record
- Compliance
- AWS states Cognito is HIPAA eligible and compliant with PCI DSS, SOC, and several ISO standards.aws.amazon.com · read 2 Oct 2026
- Developer integrations
- Cognito integrates with AWS Amplify, Lambda, AWS WAF, AppSync, Application Load Balancers, API Gateway, and Amazon Verified Permissions.aws.amazon.com · read 2 Oct 2026
- Federation
- Cognito supports social identity providers including Apple, Facebook, Google, and Amazon, as well as enterprise SAML and OIDC providers.aws.amazon.com · read 2 Oct 2026
- Logging
- Cognito supports monitoring through CloudTrail, CloudWatch Metrics, and CloudWatch Logs Insights, and can stream user event logs to CloudWatch, S3, or third-party aggregation solutions through Kinesis Data Firehose.aws.amazon.com · read 2 Oct 2026
- Passwordless login
- Cognito supports passwordless sign-in through email, SMS, and WebAuthn passkeys.aws.amazon.com · read 2 Oct 2026
- Pricing limits
- The free tier is unavailable in AWS GovCloud (US) Regions, and machine-to-machine token requests have no free tier.aws.amazon.com · read 2 Oct 2026
- Purpose
- Amazon Cognito provides sign-up, sign-in, access control, and brokered AWS service access for web and mobile applications.aws.amazon.com · read 2 Oct 2026
- Scale
- AWS says Cognito identity stores can scale to millions of users.aws.amazon.com · read 2 Oct 2026
- SDK languages
- The Cognito SDK is available for Java, C++, PHP, Python, Golang, Ruby, .NET, and JavaScript.aws.amazon.com · read 2 Oct 2026
- Security
- Cognito supports MFA, compromised credential detection, and risk-based adaptive authentication; some advanced threat protections are Plus-tier features.aws.amazon.com · read 2 Oct 2026
- Service level
- The Cognito tier comparison lists a 99.9% service level agreement for Lite, Essentials, and Plus.aws.amazon.com · read 2 Oct 2026
- Use cases
- AWS describes Cognito for customer identity, B2B multi-tenancy, machine-to-machine authorization, and authentication of microservices and workloads.aws.amazon.com · read 2 Oct 2026
