# Cognito

AWS Cognito user authentication and authorization service.

- Repository: https://github.com/itsmostafa/aws-agent-skills (1171 stars)
- Category: DevOps
- License: MIT
- Last updated: 2026-10-26
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add itsmostafa/aws-agent-skills --skill cognito -g -a claude-code -y`
Codex: `npx skills add itsmostafa/aws-agent-skills --skill cognito -g -a codex -y`
Cursor: `npx skills add itsmostafa/aws-agent-skills --skill cognito -g -a cursor -y`
Gemini CLI: `npx skills add itsmostafa/aws-agent-skills --skill cognito -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add itsmostafa/aws-agent-skills`

## Description

AWS Cognito user authentication and authorization service. Use when setting up user pools, configuring identity pools, implementing OAuth flows, managing user attributes, or integrating with social identity providers.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# AWS Cognito

Amazon Cognito provides authentication, authorization, and user management for web and mobile applications. Users can sign in directly or through federated identity providers.

## Table of Contents

- [Core Concepts](#core-concepts)
- [Common Patterns](#common-patterns)
- [CLI Reference](#cli-reference)
- [Best Practices](#best-practices)
- [Troubleshooting](#troubleshooting)
- [References](#references)

## Core Concepts

### User Pools

User directory for sign-up and sign-in. Provides:
- User registration and authentication
- OAuth 2.0 / OpenID Connect tokens
- MFA and password policies
- Customizable UI and flows

### Identity Pools (Federated Identities)

Provide temporary AWS credentials to access AWS services. Users can be:
- Cognito User Pool users
- Social identity (Google, Facebook, Apple)
- SAML/OIDC enterprise identity
- Anonymous guests

### Tokens

| Token | Purpose | Lifetime |
|-------|---------|----------|
| **ID Token** | User identity claims | 1 hour |
| **Access Token** | API authorization | 1 hour |
| **Refresh Token** | Get new ID/Access tokens | 30 days (configurable) |

## Common Patterns

### Create User Pool

**AWS CLI:**

```bash
aws cognito-idp create-user-pool \
  --pool-name my-app-users \
  --policies '{
    "PasswordPolicy": {
      "MinimumLength": 12,
      "RequireUppercase": true,
      "RequireLowercase": true,
      "RequireNumbers": true,
      "RequireSymbols": true
    }
  }' \
  --auto-verified-attributes email \
  --username-attributes email \
  --mfa-configuration OPTIONAL \
  --user-attribute-update-settings '{
    "AttributesRequireVerificationBeforeUpdate": ["email"]
  }'
```

### Create App Client

The rest: https://github.com/itsmostafa/aws-agent-skills/blob/HEAD/skills/cognito/SKILL.md