AWS Cognito
Amazon's bundled identity service. Cheap at scale, complex to set up, AWS-locked.
VISIT AWS COGNITOKey takeaway: There is exactly one situation where Cognito is worth the pain: you are AWS-committed, at a scale where per-user pricing from Clerk or Auth0 would hurt, and you have someone who knows IAM. Everywhere else the setup cost outweighs the savings. Treat the cheap rate as compensation for the engineering time you are about to spend.
Quick facts
- CategoryBundled with platform
- LanguageTypeScript
- PricingFreemium
- LicenseProprietary
- Created2014
- GitHub starsclosed
- HIPAA-eligibleYes (BAA)
- SSO / SAMLOut of box
What it is
AWS Cognito is Amazon's identity product. User pools + identity pools, MFA, social logins, SAML federation. Cheap once configured (50k free MAUs); complex to set up correctly, with documentation that lags the product. Used by AWS-locked teams who want auth in the same account.
Best for
- AWS-first teams that want auth in the same procurement contract
- High-scale apps where per-MAU pricing makes Clerk / Auth0 unattractive
When not to pick it
Skip Cognito for any project where developer time matters more than monthly auth bill. The setup pain is real and persistent.
My take
Cognito is cheap at scale and a real time-sink to set up. Most teams should pick something else unless AWS-locked is non-negotiable.
User pools, identity pools, and the learning curve
Cognito is two products wearing one name. User pools are the directory and authentication service that issues tokens. Identity pools exchange those tokens for temporary AWS credentials so a client can talk to S3 or DynamoDB directly. Teams routinely configure the wrong one, or both when they needed one. Add hosted UI customisation that is more limited than you expect, triggers implemented as Lambda functions, attribute schemas you cannot freely change after creation, and documentation that lags the console, and the first week is genuinely frustrating. It is not that Cognito is broken. It is that almost every decision is exposed to you and several are hard to reverse without recreating the pool and migrating users. Budget real time for the initial build and write the configuration as infrastructure-as-code from day one, because clicking through the console is how you end up with a production setup nobody can reproduce.
Why the economics still tempt people
Per-monthly-active-user pricing from the hosted vendors is fine at ten thousand users and painful at several million. Cognito's rate is a fraction of theirs at volume, and it bills inside the AWS account and contract you already have, which removes a procurement conversation as well as a line item. For a consumer app with a large, lightly engaged user base that difference can be the entire argument. Weigh it honestly though: the saving has to exceed the engineering time spent on setup, the ongoing cost of an unfamiliar configuration surface, and the risk that the one person who understood the pool leaves the company. For most teams below serious scale that arithmetic does not work, and the directory entry is right that developer time is usually worth more than the monthly bill.
Frequently asked questions
Is AWS Cognito hard to set up?
Yes, harder than any of the modern hosted alternatives. The split between user pools and identity pools confuses newcomers, several pool settings are effectively fixed once created, customisation happens through Lambda triggers, and the documentation trails the product. Define everything in infrastructure-as-code from the start so the configuration is reproducible rather than clicked together.
Is Cognito cheaper than Clerk or Auth0?
At scale, substantially. Cognito bills at a low per-active-user rate inside your existing AWS account, while the hosted vendors charge a premium per active user. The saving only matters once you have a lot of users, because below that threshold the extra engineering time costs considerably more than the difference on the invoice.
Does Cognito support SAML and enterprise SSO?
Yes. User pools support SAML and OIDC federation with external identity providers, so enterprise SSO is achievable. The experience of configuring it is less pleasant than WorkOS or Auth0, where the same outcome takes a fraction of the time, so pick Cognito for this only when AWS alignment is already the deciding factor.
Links
Similar tools you should also consider
If AWS Cognito is your pick, the next conversation is short
The 30-min call is where your auth choice becomes a real architecture, a migration plan if you are switching, and a price range you can take to your stakeholders. Describe your stack, your scale, your compliance constraints. I tell you whether AWS Cognito is genuinely your fit.