# AWS Auth

Adds user authentication to web and mobile apps with Amazon Cognito (user pools and...

- Repository: https://github.com/aws/agent-toolkit-for-aws (3366 stars)
- Category: Design
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add aws/agent-toolkit-for-aws --skill aws-auth -g -a claude-code -y`
Codex: `npx skills add aws/agent-toolkit-for-aws --skill aws-auth -g -a codex -y`
Cursor: `npx skills add aws/agent-toolkit-for-aws --skill aws-auth -g -a cursor -y`
Gemini CLI: `npx skills add aws/agent-toolkit-for-aws --skill aws-auth -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add aws/agent-toolkit-for-aws`

## Description

Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries. Covers sign-up/sign-in flows and the login page (Cognito-hosted UI / managed login), MFA, password policies, OAuth 2.0 / OIDC flows (auth-code + PKCE, client credentials), social/SAML federation, tokens (ID/access/refresh, rotation, revocation, storage), Cognito Lambda triggers, identity pools (temp AWS creds), and gating API Gateway (or ALB) routes to signed-in users via Cognito/JWT authorizers. Applies when adding a login or sign-up page, configuring a user pool or app client, choosing user pool vs identity pool, wiring social/SAML, refreshing tokens, requiring sign-in on an API Gateway or ALB, or debugging redirect_uri/token/MFA/CORS/federation errors. Does NOT cover Amplify Gen2 backend definitions (defineAuth, npx ampx → aws-amplify), IAM/STS/Identity Center (→ aws-iam), or API Gateway/Lambda resource config beyond the authorizer (→ aws-serverless).

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# AWS Auth (Amazon Cognito)

Application-level user authentication and authorization with Amazon Cognito and the Amplify
client auth libraries. Verify specific limits, quotas, and exact API shapes against official AWS
documentation when precision matters; trust the docs over memory when they conflict.

**Recommended:** The AWS MCP server provides streamlined access to the AWS APIs used in this skill (Cognito user pool/app client/identity pool setup, API Gateway authorizers). If it is unavailable, the AWS CLI commands shown throughout work directly, the skill has no hard dependency on MCP.

**When NOT to use:** Amplify Gen2 backend code (`defineAuth`, `amplify/auth.ts`, `npx ampx`); IAM
policy/role/trust-policy authoring, STS, or IAM Identity Center console SSO; API Gateway
route/integration setup or Lambda function implementation (this skill covers only the Cognito/JWT
authorizer configuration and the purpose of Cognito Lambda triggers).

## User Pool vs Identity Pool, pick first

These are different services that are frequently confused. Most apps need a **user pool**; add an
**identity pool only if** the client must call AWS services directly.

| You need... | Use | Why |
|-------------|-----|-----|
| Sign-up / sign-in, user directory, issue JWTs | **User pool** | It authenticates users and is an OIDC IdP |
| The signed-in client to call S3/DynamoDB/etc. directly with AWS credentials | **Identity pool** | It exchanges a token for temporary AWS credentials via STS |
| Both (sign in, then hit AWS resources from the browser/app) | User pool → identity pool | Identity pool trusts the user pool as its IdP |

If your app only calls your own backend/API, you do **not** need an identity pool, send the user
pool token to your API. See [identity-pools.md](references/identity-pools.md).

## Critical Warnings

The rest: https://github.com/aws/agent-toolkit-for-aws/blob/HEAD/plugins/aws-core/skills/aws-auth/SKILL.md