cognito

1# AWS Cognito
2 
3Amazon Cognito provides authentication, authorization, and user management for web and mobile applications. Users can sign in directly or through federated identity providers.
4 
5## Table of Contents
6 
7- [Core Concepts](#core-concepts)
8- [Common Patterns](#common-patterns)
9- [CLI Reference](#cli-reference)
10- [Best Practices](#best-practices)
11- [Troubleshooting](#troubleshooting)
12- [References](#references)
13 
14## Core Concepts
15 
16### User Pools
17 
18User directory for sign-up and sign-in. Provides:
19- User registration and authentication
20- OAuth 2.0 / OpenID Connect tokens
21- MFA and password policies
22- Customizable UI and flows
23 
24### Identity Pools (Federated Identities)
25 
26Provide temporary AWS credentials to access AWS services. Users can be:
27- Cognito User Pool users
28- Social identity (Google, Facebook, Apple)
29- SAML/OIDC enterprise identity
30- Anonymous guests
31 
32### Tokens
33 
34| Token | Purpose | Lifetime |
35|-------|---------|----------|
36| **ID Token** | User identity claims | 1 hour |
37| **Access Token** | API authorization | 1 hour |
38| **Refresh Token** | Get new ID/Access tokens | 30 days (configurable) |
39 
40## Common Patterns
41 
42### Create User Pool
43 
44**AWS CLI:**
45 
46```bash
47aws cognito-idp create-user-pool \
48  --pool-name my-app-users \
49  --policies '{
50    "PasswordPolicy": {
51      "MinimumLength": 12,
52      "RequireUppercase": true,
53      "RequireLowercase": true,
54      "RequireNumbers": true,
55      "RequireSymbols": true
56    }
57  }' \
58  --auto-verified-attributes email \
59…