Cognito

Basics

• Service provides Authentication, Authorization & User Management for web and mobile apps
• User Pools - Sign In & on success get JWT. Most AWS services do not accept JWT. Actual AWS credentials are required for these services. User pools can not be used for this purpose
• Identity Pools - They provide temporary AWS credentials in exchange of external identities
• Unauthenticated identities can be provided guest access
• Federated identities like Goggle, FB, Twitter , SAML 2.0 & User Pool can be swapped for Temporary AWS Credentials
• Identity pools assume IAM Role on behalf of the Identity