Freedom251 › Authentication Software
Amazon Cognito
What Amazon Cognito is
Amazon Cognito provides sign-up, sign-in, access control, and brokered AWS service access for web and mobile applications. It supports passwordless login by email, SMS, or WebAuthn passkeys, alongside MFA and risk-based adaptive authentication. Social identity options include Apple, Facebook, Google, and Amazon; enterprise providers can connect through SAML or OIDC. Cognito integrates with AWS Amplify, Lambda, AWS WAF, AppSync, Application Load Balancers, API Gateway, and Amazon Verified Permissions. SDKs are available for Java, C++, PHP, Python, Golang, Ruby, .NET, and JavaScript. AWS describes uses including customer identity, B2B multi-tenancy, machine-to-machine authorization, and authentication for microservices and workloads; identity stores can scale to millions of users. Cognito supports monitoring and event-log streaming, and AWS states it is HIPAA eligible and compliant with PCI DSS, SOC, and several ISO standards. A free plan is available, but not in AWS GovCloud (US) Regions; machine-to-machine token requests have no free tier. Some advanced threat protections are Plus-tier features.
Who it suits
Cognito suits teams adding identity and access controls to web or mobile applications, including customer identity and B2B use cases. It may also fit workloads that need AWS integrations, federated identity, or passwordless sign-in.
What it does well
- Supports passwordless email, SMS, and passkey login.
- Connects to social and enterprise identity providers.
- SDKs cover eight listed programming languages.
- Free tier includes eligible sign-ins.
What to know first
- Free tier is unavailable in AWS GovCloud (US) Regions.
- Machine-to-machine token requests have no free tier.
- Some advanced threat protections require Plus.
Limits
Lite and Essentials provide 10,000 monthly active users free for eligible direct or social sign-ins; Essentials also includes 50 free monthly active users for SAML/OIDC federation. Plus has no free tier for direct or social sign-ins, and machine-to-machine token requests have no free tier. SMS and email charges are separate.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Lite | Pay as you go, based on monthly active users (MAUs). · 10,000 MAUs free monthly for eligible direct or social sign-ins; usage-based rates above free tier; SMS and email charges separate | On request |
| Essentials | Pay as you go, based on monthly active users (MAUs). · 10,000 MAUs free monthly for eligible direct or social sign-ins; 50 MAUs free monthly for SAML/OIDC federation; usage-based rates above free tier; SMS and email charges separate | On request |
| Plus | Pay as you go, based on monthly active users (MAUs). · No free tier for direct or social sign-ins; usage-based rates; SMS and email charges separate | On request |
As aws.amazon.com lists them, read 2 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Amazon Cognito website.
- Choose a Lite, Essentials, or Plus tier.
- Integrate Cognito using an available SDK or AWS integration.
- Configure sign-in methods and identity providers for the application.
Verdict
Cognito combines application sign-in, federation, and access control with a wide set of AWS integrations. Check the free-tier eligibility and the Plus-tier distinction for advanced threat protection against your requirements.
Questions
Is Amazon Cognito free?
A free tier is available for eligible usage, but it is unavailable in AWS GovCloud (US) Regions. Machine-to-machine token requests have no free tier.
What is the listed starting price?
The pricing note says paid plans start at $0.01/user/mo. Usage-based rates apply above applicable free tiers, and SMS and email charges are separate.
Which sign-in methods does Cognito support?
It supports email, SMS, and WebAuthn passkeys for passwordless sign-in, plus social providers and enterprise SAML and OIDC providers.
Which platforms are listed?
The listed platforms are Android, iOS, web, and API.
What security and compliance support is described?
Cognito supports MFA, compromised credential detection, and risk-based adaptive authentication. AWS states it is HIPAA eligible and compliant with PCI DSS, SOC, and several ISO standards.
Which plans include a free tier?
Lite and Essentials include 10,000 monthly active users free each month for eligible direct or social sign-ins. Essentials also includes 50 free monthly active users for SAML/OIDC federation; Plus has no free tier for direct or social sign-ins.
Facts from Amazon Cognito's own pages
- Compliance
- AWS states Cognito is HIPAA eligible and compliant with PCI DSS, SOC, and several ISO standards. · aws.amazon.com, 2 Oct 2026
- Developer integrations
- Cognito integrates with AWS Amplify, Lambda, AWS WAF, AppSync, Application Load Balancers, API Gateway, and Amazon Verified Permissions. · aws.amazon.com, 2 Oct 2026
- Federation
- Cognito supports social identity providers including Apple, Facebook, Google, and Amazon, as well as enterprise SAML and OIDC providers. · aws.amazon.com, 2 Oct 2026
- Logging
- Cognito supports monitoring through CloudTrail, CloudWatch Metrics, and CloudWatch Logs Insights, and can stream user event logs to CloudWatch, S3, or third-party aggregation solutions through Kinesis Data Firehose. · aws.amazon.com, 2 Oct 2026
- Passwordless login
- Cognito supports passwordless sign-in through email, SMS, and WebAuthn passkeys. · aws.amazon.com, 2 Oct 2026
- Pricing limits
- The free tier is unavailable in AWS GovCloud (US) Regions, and machine-to-machine token requests have no free tier. · aws.amazon.com, 2 Oct 2026
- Purpose
- Amazon Cognito provides sign-up, sign-in, access control, and brokered AWS service access for web and mobile applications. · aws.amazon.com, 2 Oct 2026
- Scale
- AWS says Cognito identity stores can scale to millions of users. · aws.amazon.com, 2 Oct 2026
- SDK languages
- The Cognito SDK is available for Java, C++, PHP, Python, Golang, Ruby, .NET, and JavaScript. · aws.amazon.com, 2 Oct 2026
- Security
- Cognito supports MFA, compromised credential detection, and risk-based adaptive authentication; some advanced threat protections are Plus-tier features. · aws.amazon.com, 2 Oct 2026
- Service level
- The Cognito tier comparison lists a 99.9% service level agreement for Lite, Essentials, and Plus. · aws.amazon.com, 2 Oct 2026
- Use cases
- AWS describes Cognito for customer identity, B2B multi-tenancy, machine-to-machine authorization, and authentication of microservices and workloads. · aws.amazon.com, 2 Oct 2026
Where Amazon Cognito stands on Freedom251
- Authentication Software#1 of 31
- Passkey Authentication Software#3 of 55
- Single Sign-On Software#2 of 34
- Identity and Access Management Software#3 of 45
- Customer Identity and Access Management Software#3 of 29
- OAuth Server Software#4 of 32