Amazon Cognito User Pools (CUP) | Overview.

Amazon Cognito User Pools (CUP) - Overview.

Scope:

• Intro,
• Cognito User Pools,
• Core User Features,
• User Profile & Identity Management,
• Security Features,
• Developer & Customization Features,
• Scalability & Integration,
• Final takeaway.

Intro:

• An Amazon Cognito user pool is a secure user directory that provides an identity and authentication layer for web and mobile applications, capable of scaling to millions of users. 
• Cognito user pool is a fully managed service that acts as an OpenID Connect (OIDC) identity provider (IdP) for twtech applications.

Cognito User Pools

🔑 Core User Features

1. User Sign-up & Sign-in
• Self-registration flows (email, phone, or username).
• Password-based authentication with customizable complexity rules.
• Social sign-in (Google, Facebook, Apple, Amazon).
• Enterprise sign-in via SAML 2.0 or OpenID Connect (OIDC) IdPs.
2. Multi-Factor Authentication (MFA)
• Supports SMS-based MFA and TOTP (Authenticator Apps).
• Optional or required per-user/group.
• Adaptive authentication with risk-based policies.
3. Password & Credential Management
• Self-service password reset.
• Temporary passwords for admin-created accounts.
• Automatic account recovery (email/phone verification).

👤 User Profile & Identity Management

4. User Directory (Profile Store)
• Secure storage of user attributes.
• Default attributes: name, email, phone number, preferred_username.
• Custom attributes (app-specific data).
5. Account Linking
• Merge social/enterprise logins with a CUP-native account.
• Supports seamless federation + local profile.
6. Attribute Verification
• Email/phone verification codes.
• Configurable workflows (automatic or manual confirmation).

🛡 Security Features

7. Advanced Security Features (ASF)
• Compromised credential checks (stolen password detection).
• Adaptive authentication (challenge only when risk is detected).
• Risk-based sign-in (e.g., unfamiliar device, location).
8. Session & Token Management
• Secure JWT tokens: ID token, access token, refresh token.
• Configurable expiration times.
• Built-in support for OAuth 2.0 flows (Auth Code, Implicit, Client Credentials, etc.).

🔧 twtech-Developer & Customization Features

9. Hosted UI
• Pre-built, customizable login/registration UI.
• Supports branding (logo, CSS, domain).
10. Custom Authentication Flows
• Lambda triggers to customize:
• Sign-up (pre-signup, post-confirmation).
• Sign-in (pre-authentication, post-authentication).
• MFA & challenges (Define Auth Challenge, Verify Challenge Response).
• Can implement passwordless login, magic links, or biometric checks.
11. Fine-Grained Access Control
• Define user groups, roles, and permissions.
• Integration with IAM roles for role-based access to AWS resources.

🌍 Scalability & Integration

12. Scalable & Global
• Fully managed user directory (millions of users).
• Integrates with Amazon CloudFront for global low-latency sign-in.
13. APIs & SDKs
• Native SDKs for iOS, Android, JavaScript, and backend frameworks.
• Integration with AWS Amplify.

Final takeaway:

• Cognito User Pools provide user authentication, federation, MFA, advanced security, and profile management, with built-in customization hooks so twtech can create anything from simple login forms to fully custom identity workflows.