Security, Identity, and Compliance
CoreAmazon Cognito
Application identity service with user pools for user directories and tokens and identity pools for supported federation to temporary AWS credentials.
Key points
- User pools authenticate application users and issue tokens.
- Identity pools can exchange supported identities for temporary role credentials.
- Token validation and application authorization remain explicit API responsibilities.
Best-known use cases
- User sign-up, sign-in, and token issuance.
- Federated temporary AWS access for authorized application users.
What candidates often confuse it with
- Cognito serves application users; IAM roles and STS serve AWS principal permissions and temporary sessions.
- User-pool tokens are not universal credentials for arbitrary AWS service APIs.
Key takeaway
Use Cognito for application-user identity, then enforce token claims and resource authorization at the correct boundary.
Related services
- Amazon API Gateway
- AWS Identity and Access Management (IAM)
- AWS Security Token Service (AWS STS)
Relevant exam tasks
- D2.1 — Implement authentication and/or authorization for applications and AWS services
- 2.1.1 — Use an identity provider to implement federated access (for example, Amazon Cognito, IAM)
- 2.1.2 — Secure applications by using bearer tokens
- 2.1.7 — Implement application-level authorization for fine-grained access control