CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Amazon Cognito — User Identity and Access Management: When to Use What
Learn how to choose and implement Amazon Cognito for user authentication. Understand exam focus areas to pass the AWS Certified Solutions Architect exam.
When building applications, user authentication is crucial. Amazon Cognito simplifies this process, allowing developers to focus on features rather than identity management. It handles user sign-up, sign-in, and access control. It supports integrations with social identity providers like Google and Facebook, as well as enterprise providers via SAML. Knowing when to use Cognito can save time and enhance security.
When to Choose Amazon Cognito
Cognito is the go-to service when:
- User Authentication and Management: You need a solution for managing user accounts in web or mobile apps. Cognito handles everything from sign-up to sign-in.
- Social Logins: When you want to enable sign-in through social media accounts or enterprise identity providers. This saves development time compared to building these features from scratch.
- Secure AWS Access: If your application requires secure access to AWS resources, Cognito can manage user sessions effectively.
Key Architectural Decisions
When implementing Cognito, consider these decisions:
- User Pools vs. Identity Pools: Choose User Pools for user directory management, which includes user registration and sign-in. Opt for Identity Pools for federated identities, enabling users to authenticate with external providers.
- Multi-Factor Authentication (MFA): Implement MFA for added security, especially for sensitive applications.
- Password Policies and Verification: Configure settings to manage password policies and user verification processes, like email or phone verification.
| Feature | User Pools | Identity Pools |
|---|---|---|
| User Management | Yes | No |
| Federated Identities | No | Yes |
| Session Management | Yes | Yes |
| MFA Support | Yes | Limited |
| Integration with AWS | Limited to AWS services | Direct access to AWS resources |
Gotchas & Exam Traps
Be mindful of the following:
- Limits: Cognito has limits on the number of users and API calls. This can impact your design, especially for large applications.
- User Pools vs. Identity Pools: Understand the differences between these two options. This distinction is a common focus on the exam.
- Region-Specific Features: Some features, like advanced security and triggers, may not be available in every region. Familiarize yourself with these limitations.
How the Exam Tests This
Question writers often focus on:
- Scenario-Based Questions: Expect questions that present a scenario requiring you to choose between User Pools and Identity Pools. Pay attention to the requirements for user management and authentication.
- Configuration Settings: Be prepared for questions about configuring settings like MFA and password policies. Understand how these settings impact the user experience and security.
- Feature Availability: Questions may ask about the availability of certain features in specific regions. Know which features are region-dependent.
The Rule to Remember
Choose User Pools for user management and Identity Pools for federated access.
For more practice, check out our free mock exam to test your knowledge: Take the free SAA-C03 mock exam.