What's changed: In-scope service coverage (axis B): added Systems Manager (Parameter Store) and AppConfig config/feature-flag externalization definitions, roles, and selection criteria to s3.
3.2User Authentication with Amazon Cognito
Understand Cognito user pools (sign-up/sign-in, JWT issuance) vs. identity pools (exchange tokens for temporary AWS credentials) and the app user-auth flow.
Amazon Cognito handles sign-in/sign-up for an app’s end users. The key is the difference between user pools and identity pools.
3.2.1User pools and identity pools
- User pool: provides sign-up/sign-in (authentication) and issues JWT tokens (ID/access tokens) on success. Handles "who are you?"
- Identity pool (federated identities): exchanges tokens for temporary AWS credentials, letting clients access S3, etc., directly. Handles "what AWS access?"
- Supports federation with external identity providers (Google, Facebook, SAML/OIDC, etc.).
- API Gateway can validate a user pool’s JWT with a Cognito authorizer.
For app end users, first separate authentication (who you are) from AWS authorization (what you can access). A user pool handles sign-up/sign-in and returns JWT tokens on success; the app can pass those to an API Gateway Cognito authorizer to call protected APIs. When a client needs to call AWS services like S3 or DynamoDB directly, use an identity pool to exchange the user pool (or external IdP) tokens for temporary AWS credentials. The two are typically combined: "authenticate with the user pool → get AWS authorization via the identity pool." MFA, the Hosted UI, and SRP-based password protection are user-pool features.
| Aspect | User pool | Identity pool |
|---|---|---|
| Role | Authentication (who) | AWS authorization (what) |
| Output | JWT tokens | Temporary AWS credentials |
| Use | Sign-in, protect APIs | Call S3/DynamoDB directly |
A user pool issues three token types: an ID token with user attributes (e.g., email), an access token for API authorization, and a refresh token to obtain new tokens after expiry. All are JWTs; when they expire, use the refresh token to renew. For stronger security, use MFA (SMS/TOTP) and SRP (Secure Remote Password) so passwords aren’t sent in plaintext. To inject custom logic around sign-up or token generation, use Lambda triggers (pre/post authentication, pre token generation, etc.) to run custom validation or add claims. To stand up a login screen quickly without building your own, the Hosted UI is handy and can integrate external IdP buttons like Google. These are all user-pool features; the identity pool sticks to its job of "exchanging for AWS credentials."
Scenario: a mobile app uploads photos straight to S3 after login. Sign in with the user pool to get a JWT. Protected APIs are guarded by an API Gateway Cognito authorizer validating the JWT. To write directly to S3, the client exchanges the JWT for temporary AWS credentials via an identity pool, scoped to least privilege (PutObject only on that user’s prefix).
Q. User pool vs. identity pool? User pool = authentication (issues JWT); identity pool = exchanges tokens for temporary AWS credentials. Q. Validate JWT at API Gateway? Use a Cognito authorizer. Q. Use external Google login? Yes, via federation.
Watch the mix-up: Don’t swap "issues JWT = user pool" with "temporary AWS credentials = identity pool." To call AWS services directly from the client you need an identity pool; a user pool alone does not yield AWS credentials.
Common on DVA: app sign-in/sign-up = user pool (issues JWT), exchange tokens for temporary AWS credentials = identity pool. API Gateway can validate this JWT with a Cognito authorizer.
3.2.2Section summary
- User pool = authentication (JWT) / identity pool = temporary AWS credentials
- API Gateway validates the JWT with a Cognito authorizer
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. What provides app end-user sign-up/sign-in and issues JWT tokens?
Q2. What exchanges post-sign-in tokens for temporary AWS credentials to access S3, etc.?
Q3. What in API Gateway validates a Cognito user pool JWT to control access?