Service comparisons / User pools vs Identity pools
Cognito user pools vs identity pools
An Amazon Cognito user pool signs users in and issues JWTs; an identity pool exchanges a sign-in for temporary AWS credentials. What each does and when an app needs one or both.
Last checked against AWS documentation · How we write our content
| Question | User pools | Identity pools |
|---|---|---|
| Job | Authentication, proving who the user is | Authorization to AWS, giving the user AWS credentials |
| Gives the app | ID, access and refresh tokens (JWTs) | Temporary AWS credentials from STS, limited by an IAM role |
| Users come from | Its own directory, or social and SAML/OIDC identity providers | A user pool, social providers, SAML or OIDC providers, or guest (unauthenticated) access |
| Use it to | Sign users up and in, add MFA, protect APIs with a JWT authorizer | Let the app call S3, DynamoDB or other AWS services directly |
| Extras | Hosted sign-in pages, Lambda triggers, threat protection | Different IAM roles per group or per attribute |
Cognito has two parts with confusingly similar names. A user pool is a user directory that handles sign-in. An identity pool is a credentials broker that turns an identity into short-lived AWS permissions.
How to choose
- “Add sign-up and sign-in to a web or mobile app” or “social login”: user pool.
- “Protect an API Gateway API so only signed-in users can call it”: user pool with a Cognito authorizer, or a JWT authorizer for HTTP APIs.
- “The mobile app uploads photos directly to S3”: identity pool, with an IAM role that only allows the user’s own prefix.
- Both: users sign in with the user pool, then the identity pool swaps the token for AWS credentials.
Exam traps
- Long-term access keys in an app are always wrong. Use an identity pool’s temporary credentials.
- Workforce sign-in (employees to the AWS console and business apps) is IAM Identity Center, not Cognito.
- Scope S3 access per user with an IAM policy variable such as
${cognito-identity.amazonaws.com:sub}in the resource path.