Amazon Cognito

User Pools — sign-in for web/mobile apps. Username/password, social sign-in (Google, Facebook), SAML. Integrates with API Gateway and ALB.
Identity Pools (Federated Identities) — provide temporary AWS credentials so users can directly access AWS resources (S3, DynamoDB). Exchange Cognito User Pool token for AWS credentials.

Rule of thumb: "hundreds of users", "mobile users", "authenticate with SAML" → Cognito (not IAM).

References

Amazon Cognito (Developer Guide)

AWS Directory Services Next module: Security Controls

Quiz

A few quick questions based on this unit. Mark it complete when you are done.

Completed

Question 1 / 3

What is User Pools?

set the maximum permissions an IAM entity can get. Useful for delegating without escalation risk.up to 90% off. Can be interrupted with 2-minute warning. For fault-tolerant, stateless workloads.sign-in for web/mobile apps. Username/password, social sign-in (Google, Facebook), SAML. Integrates with API Gateway and ALB.for EC2 instances or AWS services that need to call other services. Temporary credentials.