Introduction
Amazon Cognito contains two components that are frequently confused, the user pool and the identity pool. They solve different problems. A user pool confirms who a user is, and an identity pool grants an application temporary access to AWS services. This guide compares the two and explains when each should be used. A general overview is provided in the guide on what Amazon Cognito is.
What is being compared?
A user pool is concerned with authentication, which is the confirmation of a user's identity. It manages registration and sign-in and issues tokens. An identity pool is concerned with access to AWS resources. It takes an identity that has already been proven, whether by a user pool or by an external provider, and returns temporary AWS credentials that are limited by a permission policy.
Why the distinction matters
Because the two components have similar names, the wrong one is often selected. A design that requires only sign-in does not need an identity pool, and a design that must call AWS services directly cannot rely on a user pool alone. Understanding the distinction prevents unnecessary complexity and avoids security gaps.
How each works
A user pool receives a registration or sign-in request, verifies the credentials, and issues an ID token, an access token, and a refresh token. These tokens are used to prove the identity of the user to an application or an API.
An identity pool receives an identity, either the token from a user pool or an assertion from an external provider, and returns temporary AWS credentials. These credentials are governed by an IAM role, which is a set of permissions defined in AWS Identity and Access Management. The credentials expire after a short period, which limits the risk if they are exposed.
Comparison diagram
What a user pool provides
- A user directory. Registration, sign-in, and account management.
- Tokens. Signed proof that a user has signed in.
- Multi-factor authentication. A second proof of identity.
- Federation. Sign-in through external providers.
What an identity pool provides
- Temporary AWS credentials. Short-lived access to AWS services.
- Permission control. Access limited by an IAM role.
- Guest access. Limited credentials for users who have not signed in, when configured.
- Multiple providers. Identities from user pools or external providers can be accepted.
When to use each
- A user pool alone suits an application that authenticates users and calls its own backend through an API.
- An identity pool is required when the application must access AWS services such as Amazon S3 directly with temporary credentials.
- The two are used together when a user is authenticated by a user pool and then granted direct AWS access through an identity pool.
Best practices
- A user pool should be used for authentication, and an identity pool should be added only when direct AWS access is required.
- The IAM role used by an identity pool should follow the principle of least privilege.
- Temporary credentials should be obtained only when they are needed, rather than being held for long periods.
- Tokens issued by a user pool should always be validated before access is granted.
Common mistakes
- An identity pool is added when only sign-in is required, which adds needless complexity.
- A user pool is expected to grant AWS access on its own, which it cannot do.
- The IAM role of an identity pool is given broad permissions, which increases risk.
- The two components are treated as interchangeable rather than as complementary.
Related AWS services
- AWS Identity and Access Management defines the roles that an identity pool uses.
- Amazon API Gateway validates the tokens issued by a user pool.
- Amazon S3 and other AWS services are accessed with the credentials that an identity pool provides.
Frequently Asked Questions
- What does a user pool do?
- A user pool is a user directory that manages sign-up and sign-in and issues tokens that prove who a user is. Its purpose is authentication.
- What does an identity pool do?
- An identity pool exchanges a proven identity for temporary AWS credentials that are limited by a permission policy. Its purpose is controlled access to AWS services.
- Are both always required?
- No. Many applications need only a user pool. An identity pool is required only when the application must access AWS services directly with temporary credentials.
- Can they be used together?
- Yes. A user pool can authenticate the user, and the resulting identity can then be passed to an identity pool to obtain temporary AWS credentials.
- Can an identity pool be used without a user pool?
- Yes. An identity pool can accept identities from external providers, so it can grant AWS credentials without a Cognito user pool.
This article is the summary. The book is the full, continuously updated reference: user pools, identity pools, federated access, IAM roles, and real-world integration.
View the book