Security, Identity, and Compliance
Amazon Cognito
Amazon Cognito manages user directories, federation, tokens, and temporary AWS credentials for web and mobile applications. It authenticates GenAI users while backend authorization still decides which models, tools, and documents each identity may access.
Key points
- User pools issue standards-based tokens for application authentication
- Identity pools exchange identities for scoped AWS credentials
- Groups and token claims can inform, but should not replace, resource authorization checks
When to use it
- Authenticate customers to a chat application
- Federate workforce identities into an AI self-service portal
Exam tips
- Choose Cognito for application identity and IAM Identity Center for workforce AWS access
- Validate token issuer, audience, signature, expiry, and tenant ownership at the API boundary