Cognito

Question 1

What does Amazon Cognito provide?

Answer 1

Authentication, authorization, and user management for web and mobile applications.

Question 2

What is a User Pool in Cognito?

Answer 2

User pools provide sign-in and provide JSON Web Tokens (JWT). User pools DO NOT grant access to AWS resources.

User pools provide user sign-up, sign-in (customizable web UI), MFA, and user profiles.

Question 3

What is an Identity Pool in Cognito?

Answer 3

Identity Pools offer access to temporary AWS credentials. This supports:
- Unauthenticated identities (guest/anonymous users)
- Federated identities (swap third-party and User Pool JWTs for short term AWS credentials (Roles) to access AWS resources)

Question 4

Can API Gateway accept User Pool tokens or must they be swapped for Identity Pool credentials?

Answer 4

API Gateway can accept User Pool tokens directly.

Question 5

How can you create a Federated Web Identity system using Cognito?

Answer 5

Log in to a User Pool using a third party identity provider and receive a JWT. Swap that JWT in an Identity Pool for a Role to access AWS resources.

Question 6

Why would you use Cognito instead of IAM to create and manage users for your application?

Answer 6

IAM has a 5,000 user limit. Cognito can use Federate Web Identity to have infinite users.