Cognito User Pools give you signup, password policies, MFA, and JWTs AWS services understand. Identity Pools (federated identities) layer temporary AWS credentials for mobile or JS apps hitting AWS APIs directly—but widen your threat model when you use them.

Implementation habits

  • Use groups and custom attributes for roles, but keep authorization logic in your API—not only in token claims.
  • Brand the hosted UI or build your own OAuth flow; test refresh token rotation on mobile.
  • Log auth events to CloudWatch or SIEM; lock down unused IdP clients and rotate app secrets.

If Cognito’s limits or pricing curve bite in 2026, document the exit path—often a thin abstraction over OIDC keeps you from hard-coding vendor SDKs everywhere.