Cognito Under the Hood
Aug
Have you ever implemented a user database and authentication layer yourself? There are many things to get right: Hashing and salting passwords, multi-factor authentication, brute force attacks, and many more. That’s why I recommend using a production-ready service instead of building authentication yourself. That’s what Amazon Cognito is all about.
Let me start with typical use cases for Cognito:
Serverless app with API Gateway
A typical Serverless application uses Cognito User Pools for authentication and authorization.
- The client authenticates with the User Pool.
- The client sends the identity or access token as a header to the API Gateway.
- The API Gateway verifies the token and grants access.
- The API Gateway adds information from the identity/access token to the context when invoking a Lambda function.
Obtain temporary AWS credentials
Cognito Identity Pool allows federated identities to access AWS resources by issuing temporary AWS access credentials. Users can use those credentials to interact with AWS APIs directly (e.g., AppSync, S3, DynamoDB, …). That allows clients to access data stores without a backend.
Cloud-native app with ALB
You can add authentication to any cloud-native app that sits behind an ALB. ALBs support authentication/authorization based on Cognito User Pools.
We use it to add a layer of security for traditional tools like Jenkins, phpMyAdmin, etc.
You can find a working example here: https://github.com/cfn-modules/docs/tree/master/examples/fargate-alb-auth-cognito
The following video covers:
- When to use AWS Cognito?
- Demo: ALB + Cognito User Pool
- User Pool vs. Identity Pool
- Pitfall: Backup your most valuable asset!
Summary
The following table helps you to decide which option to choose.
| User Pool | Identity Pool | |
|---|---|---|
| Built-in User Database | ✅ Yes | ❌ No |
| Grant access to AWS resources directly | ✅ Yes in combination with an Identity Pool | ✅ Yes |
| Social Login | Google, Facebook, Amazon, Apple | Google, Facebook, Amazon, Apple |
| SAML | ✅ Yes | ✅ Yes |
| OpenID Connect | ✅ Yes | ✅ Yes |
| Hosted UI | ✅ Yes | ❌ No |
| Costs | $0.0055 per Monthly Active User (MAU) | Free |
- A future-proof Terraform provider definition
- Monitor your AWS account to detect suspicious behavior in real time
- Create a serverless RESTful API with the Serverless Framework powered by API Gateway, Lambda, and DynamoDB
- Cleaning up an S3 bucket with the help of Athena
- AWS CloudFormation Update Evaluation – YAML, Cross-Stack References, Simplified Substitution
Articles on the same topic:
-
Why Certificationtest.net is Best for Google Security Operations Engineer Exam Prep
-
Unlocking Success with CertificationTest – ExamTopics and Examdump Resources
-
Latest AZ 900 Dumps for 2025 PDF Download
-
Your single AWS account is a serious risk
-
Your Lambda function might execute twice. Be prepared!
-
Your AWS Account is a mess? Learn how to fix it!
-
Worldwide availability of EC2 instance types
-
Workaround: CodePipeline for GitHub Enterprise
-
WordPress Templates for AWS CloudFormation
-
WordPress on AWS: you are holding it wrong
-
WordPress on AWS: smooth and pain free
-
What’s the CO² footprint of your architecture?
-
What’s the best AWS Compute option for your project?
-
What’s new about AWS SDK for JavaScript v3?
-
What can you do with AWS?
-
What Architects Need to Know About Networking on AWS
