Amazon Cognito
Amazon Cognito provides sign-up, sign-in, access control, and brokered AWS service access for web and mobile applications.
What Amazon Cognito is
Amazon Cognito provides sign-up, sign-in, access control, and brokered AWS service access for web and mobile applications. It supports passwordless login by email, SMS, or WebAuthn passkeys, as well as MFA and risk-based adaptive authentication. Users can connect through social providers such as Apple, Facebook, Google, and Amazon, or enterprise providers using SAML and OIDC. Cognito integrates with AWS Amplify, Lambda, AWS WAF, AppSync, Application Load Balancers, API Gateway, and Amazon Verified Permissions. SDKs are listed for Java, C++, PHP, Python, Golang, Ruby, .NET, and JavaScript. AWS describes uses including customer identity, B2B multi-tenancy, machine-to-machine authorization, and authentication for microservices and workloads; identity stores can scale to millions of users. Monitoring and log streaming are supported. AWS states that Cognito is HIPAA eligible and compliant with PCI DSS, SOC, and several ISO standards. A free plan is available, though not in AWS GovCloud (US) Regions; machine-to-machine token requests have no free tier, and some advanced threat protections require Plus.
Good
- Supports email, SMS, and passkey passwordless sign-in.
- Social and enterprise federation options are listed.
- Offers MFA and adaptive authentication.
- SDKs cover eight listed languages.
- Free tier includes up to 10,000 eligible monthly active users.
Watch out
- Free tier is unavailable in AWS GovCloud (US) Regions.
- Machine-to-machine token requests have no free tier.
- SMS and email charges are separate.
- Some advanced threat protections require Plus.
Who it suits
Cognito suits developers adding identity and access control to web or mobile apps, including applications using social or enterprise identity providers. Its listed integrations and SDKs also support teams building around AWS services.
Verdict
Amazon Cognito provides a broad set of sign-in and access-control options, with AWS integrations and identity features for several application types. Check tier-specific free usage and separate messaging charges before choosing a plan.
Plans and prices
From Amazon Cognito's own pricing page, checked 2 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Essentials | — | 10,000 MAUs free monthly for eligible direct or social sign-ins; 50 MAUs free monthly for SAML/OIDC federation; usage-based rates above free tier; SMS and email charges separate · Pay as you go, based on monthly active users (MAUs). |
| Lite | — | 10,000 MAUs free monthly for eligible direct or social sign-ins; usage-based rates above free tier; SMS and email charges separate · Pay as you go, based on monthly active users (MAUs). |
| Plus | — | No free tier for direct or social sign-ins; usage-based rates; SMS and email charges separate · Pay as you go, based on monthly active users (MAUs). |
The facts
Each one read from Amazon Cognito's own pages, with the date it was checked.
What it does
- Compliance
- AWS states Cognito is HIPAA eligible and compliant with PCI DSS, SOC, and several ISO standards.checked 2 Oct 2026
- Developer integrations
- Cognito integrates with AWS Amplify, Lambda, AWS WAF, AppSync, Application Load Balancers, API Gateway, and Amazon Verified Permissions.checked 2 Oct 2026
- Federation
- Cognito supports social identity providers including Apple, Facebook, Google, and Amazon, as well as enterprise SAML and OIDC providers.checked 2 Oct 2026
- Logging
- Cognito supports monitoring through CloudTrail, CloudWatch Metrics, and CloudWatch Logs Insights, and can stream user event logs to CloudWatch, S3, or third-party aggregation solutions through Kinesis Data Firehose.checked 2 Oct 2026
- Passwordless login
- Cognito supports passwordless sign-in through email, SMS, and WebAuthn passkeys.checked 2 Oct 2026
- Pricing limits
- The free tier is unavailable in AWS GovCloud (US) Regions, and machine-to-machine token requests have no free tier.checked 2 Oct 2026
- Purpose
- Amazon Cognito provides sign-up, sign-in, access control, and brokered AWS service access for web and mobile applications.checked 2 Oct 2026
- Scale
- AWS says Cognito identity stores can scale to millions of users.checked 2 Oct 2026
- SDK languages
- The Cognito SDK is available for Java, C++, PHP, Python, Golang, Ruby, .NET, and JavaScript.checked 2 Oct 2026
- Security
- Cognito supports MFA, compromised credential detection, and risk-based adaptive authentication; some advanced threat protections are Plus-tier features.checked 2 Oct 2026
- Service level
- The Cognito tier comparison lists a 99.9% service level agreement for Lite, Essentials, and Plus.checked 2 Oct 2026
- Use cases
- AWS describes Cognito for customer identity, B2B multi-tenancy, machine-to-machine authorization, and authentication of microservices and workloads.checked 2 Oct 2026
Alternatives to Amazon Cognito
- 1
Ory
Free planOpen sourceWebAPILinuxmacOS8.4From $770 a year - 2
FusionAuth
Free planAndroidiOSWebAPI8.3From $162 a month - 3
Google Cloud Identity
Free planAndroidiOSWebAPI8.3Free plan - 4
miniOrange Identity and Access Management
Free planAndroidiOSWebAPI8.1From $2 a month - 5
WorkOS
Free planAndroidiOSWebAPI8.1From $99 a month - 6
Evolveum midPoint
Free planOpen sourceWebAPILinuxmacOS7.8Free plan