AWS Cognito User & Identity Pole

AWS Congnito User & Identity Pool

What is Cognito?

AWS Cognito is a fully managed customer identity and access management (CIAM) service by Amazon Web Services that provides secure user sign-up, sign-in, and access control for web and mobile applications. It helps developers add user identity features without building them from scratch, integrating with social providers like Google and Facebook and supporting features like multi-factor authentication (MFA) and customizable user experiences. Key components include user pools for managing user directories and identity pools for granting temporary access to AWS resources.

Baics of Congnito

• User Pools: Create and manage user identities
• Identity Pools: Grant access to your AWS resources
• Federation: Federation of users with other identity providers
• Security: Supports multi-factor authentication, password policies, and encryption
• Customization: User experience, mail and SMS messages can be customized

What is User Pool?

A user pool is a directory that handles user authentication and authorization for a web or mobile application, acting as a managed user store with features like sign-up, sign-in, user profiles, and password management. User pools enable applications to integrate with external identity providers (IdPs) like social networks or SAML, allowing for single sign-on (SSO) and secure access to different applications for users. They provide critical identity management functions without requiring the developer to build these complex features from scratch.

Users and Groups in User Pools

In a user pool, Users are individual accounts that access an application, while Groups are containers for organizing these users to manage their permissions and access control. By assigning users to groups, developers can set distinct roles (e.g., ‘admin’, ‘editor’) and map these groups to IAM roles to control access to specific resources or services, with group membership included in the user’s issued tokens.

Identity Pool

Identity pools are a component of identity and access management that act as a credential broker, granting users temporary, secure access to cloud resources, most notably AWS, by exchanging their identity provider tokens for temporary IAM credentials. They facilitate user access to resources by federating with external identity providers (like SAML, OpenID Connect, or social logins) and assigning users an IAM role, allowing for both authenticated and unauthenticated (guest) user access.