cognito

# AWS Cognito Amazon Cognito provides authentication, authorization, and user management for web and mobile applications. Users can sign in directly or through federated identity providers. ## Table of Contents - [Core Concepts](#core-concepts) - [Common Patterns](#common-patterns) - [CLI Reference](#cli-reference) - [Best Practices](#best-practices) - [Troubleshooting](#troubleshooting) - [References](#references) ## Core Concepts ### User Pools User directory for sign-up and sign-in. Provides: - User registration and authentication - OAuth 2.0 / OpenID Connect tokens - MFA and password policies - Customizable UI and flows ### Identity Pools (Federated Identities) Provide temporary AWS credentials to access AWS services. Users can be: - Cognito User Pool users - Social identity (Google, Facebook, Apple) - SAML/OIDC enterprise identity - Anonymous guests ### Tokens | Token | Purpose | Lifetime | |-------|---------|----------| | **ID Token** | User identity claims | 1 hour | | **Access Token** | API authorization | 1 hour | | **Refresh Token** | Get new ID/Access tokens | 30 days (configurable) | ## Common Patterns ### Create User Pool **AWS CLI:** ```bash aws cognito-idp create-user-pool \ --pool-name my-app-users \ --policies '{ "PasswordPolicy": { "MinimumLength": 12, "RequireUppercase": true, "RequireLowercase": true, "RequireNumbers": true, "RequireSymbols": true } }' \ --auto-verified-attributes email \ --user...