Cognito Security
Identity & AccessAmazon Cognito handles customer identity for applications. It has two main components:
User Pools (Authentication)
- Managed user directory with sign-up, sign-in, and account recovery
- Issues JWT tokens (ID token, access token, refresh token)
- Built-in MFA (SMS, TOTP, email)
- Advanced security features: compromised credential detection, adaptive authentication, bot detection
- Social and enterprise federation (Google, Facebook, Apple, SAML, OIDC)
Identity Pools (Authorization)
- Exchange tokens for temporary AWS credentials via STS
- Map authenticated and unauthenticated users to IAM roles
- Fine-grained access to AWS resources per user
Security Best Practices
- Enable advanced security features for risk-based adaptive authentication
- Configure strong password policies (length, complexity, expiration)
- Use custom authentication flows (Lambda triggers) for additional validation
- Implement token revocation for compromised sessions
Related Content
Related Terms
A security mechanism requiring two or more forms of verification (password + device/token) before granting access to an AWS account or resource.
The process of allowing external identities (corporate directory, social providers) to access AWS resources without creating IAM users, using SAML, OIDC, or IAM Identity Center.
Short-lived AWS credentials (access key, secret key, session token) issued by STS that expire automatically, eliminating the risk of permanent credential exposure.
A security model where no user, device, or network is trusted by default - every access request is verified regardless of location, using identity-based policies and continuous validation.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.