Amazon Cognito User Pools and Identity Pools

Amazon Cognito is an AWS service used to add authentication and authorization capabilities to applications, especially web, mobile, and client-facing applications. For the SAP-C02 exam, the important distinction is understanding when Cognito is being used to authenticate users versus when it is being used to grant temporary access to AWS services.

The key exam concept is the difference between Cognito user pools and Cognito identity pools:

• User pools handle sign-up, sign-in, and authentication.
• Identity pools provide temporary AWS credentials through AWS STS so users can access AWS services.

This distinction matters because many scenario-based exam questions will describe an application user who needs to either log in to an app, access an API, or directly access AWS resources such as Amazon S3, DynamoDB, or other AWS services.

Key Concepts

Amazon Cognito Overview

Amazon Cognito is commonly used when an application needs user registration, sign-in, authentication, federation, or temporary AWS credentials.

A common use case is a mobile or web application where users need to create accounts, sign in, and then interact with backend services. Cognito can be used to authenticate the user and, when needed, provide the user with temporary limited-privilege AWS credentials.

The two major Cognito components to understand are:

• Cognito user pools
• Cognito identity pools

These are related but serve different purposes.

Cognito User Pools

A Cognito user pool is a user directory for application authentication.

It allows users to sign up, sign in, and authenticate to an application. The user pool can store users directly, or it can integrate with external identity providers such as Google, Facebook, Amazon, Apple, or other supported providers.

Think of a user pool as the application’s authentication layer.

What User Pools Are Used For

User pools are used when an application needs to know who the user is.

Common use cases include:

• User registration
• User sign-in
• Password-based authentication
• Social login federation
• Multi-factor authentication
• Custom authentication flows
• Securing APIs with tokens

A user pool can act as an identity provider for the application, or it can broker authentication with external identity providers.

For example, if an application allows a user to sign in with Google, Cognito can sit between the application and Google. The user authenticates with Google, and Cognito provides the application with tokens that represent the authenticated user.

JSON Web Tokens and User Pools

After a user successfully authenticates against a user pool, Cognito returns JSON Web Tokens, commonly called JWTs.

The JWTs can include:

• ID token
• Access token
• Refresh token

These tokens are used by the application or backend services to confirm that the user has authenticated.

A common architecture is:

1. User signs in to the application.
2. Application authenticates the user against a Cognito user pool.
3. Cognito returns JWTs.
4. The application sends the token to a backend API.
5. The API validates the token before processing the request.

Cognito User Pools with API Gateway and Lambda

A common exam scenario involves a client application calling an API hosted behind Amazon API Gateway.

In this pattern, the client application authenticates with a Cognito user pool and receives a JWT. The application then includes that token when calling the API.

The API layer can validate the token before allowing the request to reach the backend application logic.

A common flow looks like this:

Client application
        |
        | Authenticate
        v
Cognito User Pool
        |
        | Returns JWT
        v
Client calls API Gateway with token
        |
        | Token inspected/validated
        v
Lambda Authorizer or API authorization layer
        |
        | Valid request forwarded
        v
AWS Lambda backend

This design helps ensure that only authenticated requests are passed to the backend application.

User Pools Do Not Provide AWS Credentials

This is one of the most important exam points.

A Cognito user pool authenticates users and issues tokens, but it does not directly provide AWS credentials.

User pools answer the question:

Who is this user?

They do not directly answer:

What AWS resources can this user access?

For AWS service access, you need an identity pool.

Cognito Identity Pools

A Cognito identity pool is used to provide users with temporary, limited-privilege AWS credentials.

Identity pools integrate with AWS Security Token Service, or AWS STS, to issue short-term credentials.

These temporary credentials allow users to access AWS services according to the permissions assigned through IAM roles.

Identity pools answer the question:

What is this authenticated identity allowed to do in AWS?

Identity Pools and AWS STS

Identity pools work with AWS STS to issue temporary credentials.

The general flow is:

1. A user authenticates through a supported identity source.
2. The identity pool receives the identity information.
3. The identity pool maps the user to an IAM role.
4. AWS STS issues temporary AWS credentials.
5. The application uses those credentials to access AWS services.

The permissions are controlled by IAM policies attached to the assumed role.

This is important because the application should not embed long-term AWS access keys. Instead, users receive temporary credentials with limited permissions.

Identity Sources for Identity Pools

Identity pools can use multiple identity sources, including:

• Cognito user pools
• Social identity providers
• SAML providers
• Guest or unauthenticated users, depending on configuration

This means an identity pool can work together with a user pool, but a user pool is not always required.

For example, a user could authenticate with a social provider and then use a Cognito identity pool to receive temporary AWS credentials.

User Pools and Identity Pools Together

User pools and identity pools are often used together when an application needs both authentication and direct access to AWS services.

A typical combined flow looks like this:

User signs in
        |
        v
Cognito User Pool authenticates the user
        |
        v
User receives JWT
        |
        v
JWT is exchanged through Cognito Identity Pool
        |
        v
Identity Pool works with AWS STS
        |
        v
Temporary AWS credentials are issued
        |
        v
Application accesses AWS services using IAM role permissions

This architecture separates authentication from AWS authorization.

The user pool authenticates the user. The identity pool authorizes access to AWS services by assigning IAM-based permissions.

Authentication vs Authorization

The cleanest way to remember the difference is:

Cognito Component	Primary Purpose	Output
User Pool	Authentication	JWT tokens
Identity Pool	AWS authorization	Temporary AWS credentials

A user pool confirms identity.

An identity pool provides access to AWS resources.

This is the core concept to remember for the exam.

Security Considerations

Cognito supports secure application authentication patterns without requiring developers to build their own user directory from scratch.

Important security features include:

• Multi-factor authentication
• Adaptive authentication
• Custom authentication flows
• Federation with external identity providers
• Temporary AWS credentials through STS
• IAM role-based authorization for AWS service access

From an architecture standpoint, the major security benefit is avoiding long-term credentials in client applications.

For mobile and browser-based applications, this is especially important. You do not want to embed static AWS access keys in an application that users can inspect or reverse-engineer.

Instead, use Cognito identity pools and AWS STS to issue temporary credentials with scoped IAM permissions.

Architecture Decision Guide

Scenario	Best AWS Choice	Why
Users need to sign up and sign in to a mobile or web application	Cognito User Pool	User pools provide a managed user directory and authentication service.
Users need to authenticate using Google, Facebook, Amazon, Apple, or another external provider	Cognito User Pool or Identity Pool federation	Cognito can broker authentication with external identity providers.
Application needs JWTs to call an API Gateway-backed API	Cognito User Pool	User pools issue JWTs that can be validated by the API layer.
API Gateway should only forward authenticated requests to Lambda	Cognito User Pool with token validation or Lambda authorizer	The JWT can be inspected before requests reach the backend Lambda function.
Authenticated users need direct access to AWS services	Cognito Identity Pool	Identity pools provide temporary AWS credentials through AWS STS.
Application users need limited access to S3, DynamoDB, or other AWS services	Cognito Identity Pool with IAM roles	IAM policies on the assumed role define what the user can access.
You need to avoid embedding long-term AWS access keys in a client application	Cognito Identity Pool	Identity pools issue short-term credentials instead of static credentials.
You need both application login and AWS service access	User Pool plus Identity Pool	The user pool authenticates the user, and the identity pool exchanges the identity for AWS credentials.

Exam-Relevant Takeaways

For the SAP-C02 exam, remember that Cognito user pools and identity pools are not interchangeable.

A user pool is for authentication. It manages sign-up and sign-in, can federate with external identity providers, and issues JWTs.

An identity pool is for AWS authorization. It exchanges identity information for temporary AWS credentials through AWS STS.

If the question says users need to log in to an application, think user pool.

If the question says users need to access AWS services directly, think identity pool.

If the scenario involves an application calling API Gateway and using a token to verify the user, a user pool is likely involved.

If the scenario involves a mobile app user needing access to Amazon S3, DynamoDB, or other AWS services without storing access keys in the app, an identity pool is likely involved.

If both requirements exist, use both:

User Pool = authenticate the user
Identity Pool = provide temporary AWS credentials

Common Exam Traps

Trap 1: Thinking User Pools Provide AWS Credentials

User pools issue JWTs, not AWS credentials.

If an exam answer says a user pool alone provides temporary IAM credentials to access AWS services, that answer is likely wrong.

Temporary AWS credentials come from an identity pool through AWS STS.

Trap 2: Confusing Authentication and Authorization

Authentication verifies who the user is.

Authorization determines what the user can access.

Cognito user pools handle authentication. Cognito identity pools support authorization to AWS services by using IAM roles and STS credentials.

Trap 3: Using Long-Term Access Keys in a Client App

For mobile or browser applications, embedding AWS access keys is a bad design.

The better pattern is to use Cognito identity pools and STS-issued temporary credentials.

Trap 4: Assuming a User Pool Is Always Required

Identity pools can work with user pools, but they can also federate with external identity providers directly.

A user pool is useful when Cognito is managing or brokering application authentication. But identity pools can also accept identities from social providers, SAML providers, or guest users depending on the architecture.

Trap 5: Sending Unvalidated Requests Directly to Backend Lambda

If an application uses API Gateway and Lambda, the API layer should validate authentication before forwarding requests to backend compute.

A JWT from a Cognito user pool can be inspected by the API authorization layer, such as a Lambda authorizer, before the request reaches the application logic.

Real-World Engineer Notes

In real environments, Cognito is often used when a team wants managed authentication without building a custom identity system. This is especially useful for startups, SaaS applications, internal portals, and mobile apps.

From an infrastructure engineering perspective, the biggest design decision is whether users only need to authenticate to the application or whether they also need direct AWS service access.

If users only need to sign in and call a backend API, a user pool may be enough. The API can validate the JWT and then the backend application can perform AWS actions using its own IAM role.

If users need direct access to AWS services from the client application, an identity pool becomes important. This allows the client to receive temporary scoped credentials instead of using hardcoded access keys.

In production, IAM role design is critical. The identity pool is only as secure as the IAM policies attached to the roles it allows users to assume. Permissions should be scoped tightly, especially for services like S3 where overly broad access can expose sensitive data.

A common architecture is to let the backend Lambda function access AWS services instead of giving client users direct service access. This gives the backend more control. However, direct access through identity pools can make sense for certain use cases, such as allowing authenticated users to upload objects directly to a specific S3 prefix.

Operationally, teams should also think about:

• How users are created and managed
• Whether MFA is required
• Whether social login is allowed
• Whether guest users are permitted
• How IAM roles are mapped
• How tokens are validated
• How token expiration and refresh are handled
• How application logs track authenticated user activity

For governance, Cognito should be reviewed alongside IAM, API Gateway, Lambda, and application security controls. Cognito is not just an app developer feature; it becomes part of the identity and access management architecture.

Quick Reference Summary

Amazon Cognito has two major components for the exam:

Cognito User Pool = authentication
Cognito Identity Pool = temporary AWS credentials

User pools manage sign-up and sign-in. They can integrate with external identity providers and issue JWTs.

Identity pools provide temporary limited-privilege AWS credentials by working with AWS STS.

User pools are commonly used with API Gateway, Lambda, and AppSync to secure application access.

Identity pools are used when authenticated or federated users need direct access to AWS services.

The most important exam distinction is:

JWTs come from user pools.
AWS credentials come from identity pools.

Flashcards

Q: What is the main purpose of an Amazon Cognito user pool?
A: A user pool provides user sign-up, sign-in, and authentication for an application.

Q: What does a Cognito user pool issue after successful authentication?
A: JSON Web Tokens, including ID tokens, access tokens, and refresh tokens.

Q: Does a Cognito user pool provide AWS credentials?
A: No. A user pool provides authentication tokens, not AWS credentials.

Q: What is the main purpose of a Cognito identity pool?
A: An identity pool provides temporary limited-privilege AWS credentials for accessing AWS services.

Q: Which AWS service issues the temporary credentials used with Cognito identity pools?
A: AWS Security Token Service, or AWS STS.

Q: What AWS component controls permissions for users receiving credentials through an identity pool?
A: IAM roles and IAM permissions policies.

Q: When should you choose a user pool over an identity pool?
A: Choose a user pool when the application needs user authentication, sign-up, sign-in, or JWT-based access to an API.

Q: When should you choose an identity pool over a user pool?
A: Choose an identity pool when users need temporary AWS credentials to access AWS services directly.

Q: Can Cognito integrate with social identity providers?
A: Yes. Cognito can integrate with providers such as Google, Facebook, Amazon, Apple, and others.

Q: What is the role of a JWT in an API Gateway and Lambda architecture?
A: The JWT proves that the user authenticated and can be validated before the request is forwarded to backend Lambda logic.

Q: What is the difference between authentication and authorization in Cognito?
A: Authentication confirms who the user is, while authorization determines what the user can access.

Q: Which Cognito component is associated with authentication?
A: Cognito user pools.

Q: Which Cognito component is associated with AWS authorization through IAM credentials?
A: Cognito identity pools.

Q: Can identity pools work with user pools?
A: Yes. Identity pools can use identities from Cognito user pools and then exchange them for temporary AWS credentials.

Q: Why should client applications avoid long-term AWS access keys?
A: Long-term keys can be exposed or abused. Temporary credentials from STS are safer and can be scoped with IAM policies.

Practice Questions

Question 1:
A company is building a mobile application. Users must be able to create accounts, sign in, and receive tokens that are sent to an API Gateway endpoint before requests are forwarded to AWS Lambda. Which AWS service component is the best fit for the authentication requirement?

A. Cognito identity pool
B. Cognito user pool
C. AWS STS
D. IAM role

Correct Answer:
B. Cognito user pool

Explanation:
A Cognito user pool is used for sign-up, sign-in, and authentication. It issues JWTs that can be used by the application when calling backend APIs.

---

Question 2:
A browser-based application needs to allow authenticated users to directly access specific AWS resources using temporary credentials. The credentials must be limited in scope and should not be hardcoded in the application. Which Cognito component should be used?

A. Cognito user pool
B. Cognito identity pool
C. API Gateway stage variables
D. Lambda environment variables

Correct Answer:
B. Cognito identity pool

Explanation:
Cognito identity pools provide temporary AWS credentials through AWS STS. Permissions are controlled using IAM roles.

---

Question 3:
An application authenticates users with a Cognito user pool. After authentication, users need access to AWS services based on IAM permissions. What additional Cognito component is needed?

A. Cognito identity pool
B. AWS Organizations
C. Amazon CloudFront
D. AWS Config

Correct Answer:
A. Cognito identity pool

Explanation:
The user pool authenticates the user and issues JWTs. To obtain temporary AWS credentials for AWS service access, the application needs a Cognito identity pool.

---

Question 4:
Which statement best describes the difference between Cognito user pools and Cognito identity pools?

A. User pools provide temporary AWS credentials, while identity pools store user passwords.
B. User pools authenticate users, while identity pools provide temporary AWS credentials for AWS service access.
C. User pools are only used for guest users, while identity pools are only used for administrators.
D. User pools are used only with SAML, while identity pools are used only with social logins.

Correct Answer:
B. User pools authenticate users, while identity pools provide temporary AWS credentials for AWS service access.

Explanation:
User pools are primarily for authentication and issue JWTs. Identity pools provide AWS authorization by exchanging identities for temporary AWS credentials through STS.

---

Question 5:
A developer wants to store AWS access keys inside a mobile application so authenticated users can upload files to Amazon S3. What is the better architecture?

A. Store long-term IAM user access keys in the mobile application.
B. Store the root user access keys in the mobile application.
C. Use Cognito identity pools to issue temporary scoped credentials through AWS STS.
D. Use a public S3 bucket and allow all users to upload objects anonymously.

Correct Answer:
C. Use Cognito identity pools to issue temporary scoped credentials through AWS STS.

Explanation:
Client applications should not contain long-term AWS credentials. Cognito identity pools allow users to receive temporary credentials with permissions controlled by IAM roles.