📖 What is Amazon Cognito?
Amazon Cognito provides authentication, authorization, and user management for web and mobile applications. It allows users to sign in using a password or social identity providers and manages user profiles and access tokens.
"This is the primary tool for 'customer-facing' identity management, whereas IAM is designed for 'internal' AWS resource management."
📚 Certification: AWS Certified Cloud Practitioner (CLF-C02)
🔑 What are the Key Concepts of Amazon Cognito?
- ▸ User Pools provide a user directory for sign-up and sign-in, managing user profiles and handling authentication via passwords or social identity providers.
- ▸ Identity Pools enable users to obtain temporary AWS credentials, allowing them to securely access other AWS services like Amazon S3 or DynamoDB.
- ▸ Federation allows users to sign in using existing accounts from external providers like Google or Facebook, improving user experience and reducing friction.
- ▸ Cognito scales automatically to support millions of users, eliminating the operational overhead of managing a custom user database and authentication backend.
🎯 How does Amazon Cognito appear on the CLF-C02 Exam?
You may be asked to select the appropriate service for a mobile application that requires a secure sign-in process for external customers using social media accounts like Google or Facebook to reduce registration friction.
A scenario might describe a requirement where a web application needs to grant temporary, limited access to an S3 bucket for guest users to upload files without creating an IAM user.
Expect questions that require you to differentiate between IAM and Cognito when deciding how to manage access for internal employees versus millions of external app users accessing a public-facing website.
❓ Frequently Asked Questions
What is the main difference between User Pools and Identity Pools?
User Pools handle authentication (who are you?) by managing user directories and sign-in. Identity Pools handle authorization (what can you do?) by exchanging those identities for temporary AWS credentials to access resources.
When should I use Cognito instead of IAM?
Use IAM for internal employees and administrators who need to manage AWS infrastructure. Use Cognito for external customers or end-users, as it is designed to scale to millions of identities.