Cognito

--- name: cognito description: AWS Cognito user authentication and authorization service. Use when setting up user pools, configuring identity pools, implementing OAuth flows, managing user attributes, or integrating with social identity providers. lastupdated : "2026-01-07" docsource :https://docs.aws.amazon.com/cognito/latest/developerguide/ --- # AWS Cognito Amazon Cognito provides authentication, authorization, and user management for web and mobile applications. Users can sign in directly or through federated identity providers. ## Table of Contents - [Core Concepts](#core-concepts) - [Common Patterns](#common-patterns) - [CLI Reference](#cli-reference) - [Best Practices](#best-practices) - [Troubleshooting](#troubleshooting) - [References](#references) ## Core Concepts ### User Pools User directory for sign-up and sign-in. Provides: - User registration and authentication - OAuth 2.0 / OpenID Connect tokens - MFA and password policies - Customizable UI and flows ### Identity Pools (Federated Identities) Provide temporary AWS credentials to access AWS services. Users can be: - Cognito User Pool users - Social identities (Google, Facebook, Apple) - SAML/OIDC enterprise identities - Anonymous guests ### Tokens | Token | Purpose | Lifetime | |-------|---------|----------| | ID Token | User identity claims | 1 hour | | Access Token | Authorization to use theAPI | 1 hour | | Refresh Token | Retrieve new ID/Access tokens | 30 days (configurable) | ## Common Patterns ### Create User Pool AWSCLI : ``bash aws cognito-idp create-user-pool \ --pool-name my-app-users \ --policies '{ "PasswordPolicy": { "MinimumLength": 12, "RequireUppercase": true, "RequireLowercase": true, "RequireNumbers": true, "RequireSymbols": true } }' \ --auto-verified-attributes email \ --username-attributes email \ --mfa-configuration OPTIONAL \ --user-attribute-update-settings '{ "AttributesRequireVerificationBeforeUpdate": ["email"] }' ` ### Create App Client `bash aws cognito-idp create-user-pool-client \ --user-pool-id us-east-1_abc123 \ --client-name my-web-app \ --generate-secret \ --explicit-auth-flows ALLOW_USER_SRP_AUTH ALLOW_REFRESH_TOKEN_AUTH \ --supported-identity-providers COGNITO \ --callback-urls https://myapp.com/callback \ --logout-urls https://myapp.com/logout \ --allowed-o-auth-flows code \ --allowed-o-auth-scopes openid email profile \ --allowed-o-auth-flows-user-pool-client \ --access-token-validity 60 \ --id-token-validity 60 \ --refresh-token-validity 30 \ --token-validity-units '{ "AccessToken": "minutes", "IdToken": "minutes", "RefreshToken": "days" }' ` ### Sign Up User `python import boto3 import hmac import hashlib import base64 cognito = boto3.client('cognito-idp') def get_secret_hash(username, client_id, client_secret): message = username + client_id dig = hmac.new( client_secret.encode('utf-8'), message.encode('utf-8'), digestmod=hashlib.sha256 ).digest() return base64.b64encode(dig).decode() response = cognito.sign_up( ClientId='client-id', SecretHash=get_secret_hash('user@example.com', 'client-id', 'client-secret'), Username='user@example.com', Password='SecurePassword123!', UserAttributes=[ {'Name': 'email', 'Value': 'user@example.com'}, {'Name': 'name', 'Value': 'John Doe'} ] ) ` ### Confirm Sign Up `python cognito.confirm_sign_up( ClientId='client-id', SecretHash=get_secret_hash('user@example.com', 'client-id', 'client-secret'), Username='user@example.com', ConfirmationCode='123456' ) ` ### Authenticate User ``python response = cognito.initiateauth ( ClientId='client-id', AuthFlow='USERSRPAUTH ', AuthParameters={ 'USERNAME': 'user@example .com', 'SECRETHASH ':getsecrethash ('user@example .com', 'client-id', 'client-secret'), 'SRPA ':srpa # From SRP library } ) # For simple password authentication (not recommended for production) response = cognito.admininitiateauth ( UserPoolId='us-east-1abc123 ', ClientId='client-id', AuthFlow='ADMINUSER_P