# Amazon Cognito

> The easiest pick for small apps, internal tools and admin panels. Everything works out of the box and it's free below 10,000 monthly users. For serious apps on Postgres, Better Auth comes first.

- Verdict: My default
- Vendor: AWS
- Layer: [Accounts, identity and cost](https://cloudlesslabs.com/stack/layers/accounts.md). Job: Authentication
- Last reviewed: 18 October 2026, by Nicolas Dao (Cloudless Labs, Sydney)
- Web page: https://cloudlesslabs.com/stack/aws-cognito/. The whole stack in one file: https://cloudlesslabs.com/stack/brief.md

I build a lot of small internal apps, and for those Cognito is friendly: hosted login, reset-password emails, Google or Microsoft sign-in, MFA, all configured rather than built, and free at their size. It's not worse than Better Auth; it's a different job.

Workers can verify Cognito JWTs at the edge, which makes it a fine identity source for the edge patterns on this page too.

## Use it when

- Internal apps and admin panels for corporate clients: they stay under the free 10,000 users, and you get the hosted login page, password reset emails and social sign-in with nothing to build.
- The app needs AWS-native identity (identity pools, IAM-secured access to AWS services, Amplify, ALB authentication).
- Enterprise SSO for lots of users on a tight budget: billed per federated user, not per connection (about $14 a month for 20 connections of 50 users).

## Don't use it when

- A serious, growing app on Postgres: users end up in two stores, Cognito and your database, kept in sync with triggers. Better Auth keeps them in one.
- You need organisations, magic links, SCIM or self-serve SSO: Cognito has none of them.

## Pricing

Lite and Essentials: 10,000 monthly active users free per account, then $0.015 per user on Essentials (Lite from $0.0055, without passkeys or email codes). Enterprise SSO users: 50 free, then $0.015 each.

## In my words: what hurts

- Limited features and identity providers.
- Users live in Cognito and in my Postgres: two systems, duplicated users.

## Gotchas, with fixes

- **Gotcha:** Cognito gives trigger Lambdas about 5 seconds. Cold container-image Lambdas blow through it and sign-in fails.
  **Fix:** Keep triggers small and zip-packaged.
- **Gotcha:** Cognito's built-in email sender is capped at 50 emails a day per AWS account.
  **Fix:** Point the user pool at SES before going live.
- **Gotcha:** Passkeys need the username first, and can only be registered after a first sign-in.
  **Fix:** Offer passkeys as an upgrade after sign-in, not as the first-time path.

## Provisioning

Official Pulumi package · Official Terraform provider

## Instead, consider

- [Better Auth](https://cloudlesslabs.com/stack/better-auth/index.md): A serious app on Postgres: users in one place, more features, no per-user fee.

## Worked examples

- [Better Auth or Cognito?](https://cloudlesslabs.com/stack/guides/sign-in/index.md): Which sign-in should my app use, and what do I actually get for free?

## Where it fits

- [Sign-in and identity](https://cloudlesslabs.com/stack/use-cases/sign-in.md): pick 2. The easy pick for small internal apps and admin panels: hosted login, reset emails and social sign-in out of the box, free under 10,000 users.

## Sources

- [Cognito pricing](https://aws.amazon.com/cognito/pricing/)
- [Cognito quotas (default email: 50 a day)](https://docs.aws.amazon.com/cognito/latest/developerguide/quotas.html)
- [Cognito Lambda triggers (5-second limit)](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html)

## Related

- [Accounts, identity and cost](https://cloudlesslabs.com/stack/layers/accounts.md): every tool in this layer, with its verdict
- [The whole stack in one file](https://cloudlesslabs.com/stack/brief.md): every use case and tool, for questions that span many
- [Map of every Markdown file on cloudlesslabs.com, with what each one answers](https://ask.cloudlesslabs.com)