Improve your app authentication workflow with new Amazon Cognito features
For application teams, the notable shift here is not just new sign-in options but a clearer separation between authentication UX, identity policy, and app code. Managed Login and the new console flow reduce the amount of custom UI and auth wiring you need to maintain, but they also make your domain choice, branding model, and deployment approach part of the architecture. That matters when identity is shared across web and mobile clients, because the same user pool now has to support different screen sizes, flows, and release cadences without fragmenting the experience.
The passwordless additions change the security and integration trade-offs. Passkeys, email OTP, and SMS OTP can reduce password handling in your application, but they also introduce dependencies on device capability, delivery channels, and fallback paths. Teams will need to think carefully about how these methods fit their existing onboarding, account recovery, and MFA policies, especially if they already rely on OpenID Connect or OAuth libraries across multiple frameworks.
The new tiering model is equally important from an operations and governance perspective. Lite, Essentials, and Plus turn Cognito into a more explicit feature-packaging decision, so platform teams should map authentication requirements to the minimum viable tier before standardizing across environments. The Plus tierโs threat protection and event log export capabilities are most relevant where security monitoring, risk-based controls, and auditability need to be integrated into broader detection and response workflows.
For infrastructure teams, the main takeaway is maintainability. AWS-managed branding, APIs, and CloudFormation support lower the burden of bespoke auth front ends, but they also make it easier to align identity configuration with infrastructure-as-code, reviewable change control, and repeatable rollout patterns. In practice, this is a move toward treating authentication as a governed platform capability rather than a custom application feature.
- A new developer-focused console experience for getting started including the support of integrating with popular application frameworks
- Introducing Managed Login โ a revamped Cognito-managed drop-in sign-in and sign-up pages and a set of customization options
- Amazon Cognito now supports passwordless login, including passkey authentication
- More options on pricing tiers: Lite, Essentials, and Plus tiers to meet your use cases
A new developer-focused console experience Amazon Cognito now offers a streamlined getting-started experience featuring a quick wizard and use case-specific recommendations. This new approach helps you set up configurations and reach your end users faster and more efficiently than ever before.
This is the new Amazon Cognito flow to help you quickly set up your application. You can get started in three steps:- Choose the type of application you need to build
- Configure the sign-in options according to the type of your application
- Follow the instructions to integrate the sign-in and sign-up pages with your application
Amazon Cognito then automatically creates your application and a newย user pool, which is a user directory for authentication and authorization. From here, you can review your sign-in page by selectingย View login pageย or get started with the example code for your application. Furthermore, Amazon Cognito supports major application frameworks and offers detailed instructions for integrating them using standard OpenID Connect (OIDC) and OAuth open source libraries.
This is the new overview dashboard for your application. The user pool dashboard now provides important information in theย Detailsย section, as well as a set ofย Recommendationsย to help you continue your development journey.
On this page, you can customize your usersโ sign-in and sign-up experience with theย Managed Loginย feature. This is a good segue for me to provide you with a quick overview of the next new feature.
Introducing Managed Login The introduction of Managed Login brings a new level of customization to Amazon Cognito. Managed Login handles the heavy lifting of availability, scaling, and security for your company. Once integrated, you automatically get all the new security patches and future features without further code changes.
This feature allows you to create personalized sign-up and sign-in experiences that are a seamless part of your companyโs application for your end users. Before you can use Managed Login, you need to assign a domain. There are two ways to do this: use a prefix domain, a randomly generated sub-domain of Amazon Cognito domain, or use your own custom domain to provide your users with a familiar domain name. Then, you can choose yourย Branding version, selecting eitherย Managed loginย orย classic Hosted UI.
If youโre an existing Amazon Cognito user, you might be familiar with the classic Hosted UI feature. Managed Login is the improved version of Hosted UI, offering a new collection of web interfaces for sign-up and sign-in, built-in responsiveness for different screen sizes, multi-factor authentication, and password-reset activities in your user pool.
With Managed Login, you can use the new branding designer, a no-code visual editor for managed login assets and style, and a set of API operations for programmatic configuration or deployment via infrastructure-as-code with AWS CloudFormation.
With the branding designer, you have the flexibility to customize the look and feel of the entire user journey, from sign up and sign in to password recovery and multi-factor authentication. This feature provides a real time preview and convenient shortcuts to preview screens in different screen sizes and display modes before you launch it.
You can learn more about Managed Login by visiting theย Managed Login documentationย page.
Passwordless login support
The Managed Login feature also offers pre-built integrations for passwordless authentication methods, including signing in with passkeys, email OTP (one-time-password) and SMS OTP. Passkey support allows users to authenticate using cryptographic keys stored securely on their devices, offering better security compared to traditional passwords. This capability helps you implement low-friction and secure authentication methods without the need to understand and implement WebAuthn related protocols.
By reducing the friction associated with traditional password-based sign-ins, this feature simplifies application access for your users while maintaining high security standards.
Visit theย user pools authentication flowย documentation page to learn more about the passwordless login support.
More options on pricing tiers: Lite, Essentials and Plus Amazon Cognito has introduced new user pool feature tiers: Lite, Essentials, and Plus. These tiers are designed to cater to different customer needs and use cases with the Essentials tier being the default tier for new users pools created by customers. This new tier structure also allows you to choose the most appropriate option based on your application requirements, with the flexibility to switch between tiers as needed.
To check your current tier, you can go to your application dashboard and selectย Feature plan. You can also selectย Settingsย from the navigation menu.
On this page, youโll get detailed information for each tier and the option to downgrade or upgrade your plan.
Hereโs a quick overview of each tier:
- Lite tier:ย Existing features such as user registration, password-based authentication, and social identity provider integration are now packaged in this tier. If youโre an existing Amazon Cognito user, you can continue using these features without making changes to your user pools.
- Essentials tier:ย Offers comprehensive authentication and access control features, allowing you to implement secure, scalable, and customized sign-up and sign-in experiences for your application within minutes. It includes all capabilities in Lite along with supporting Managed Login and passwordless login options using passkeys, email, or SMS. Essentials also supports customizing access tokens and disallowing password reuse.
- Plus tier:ย Builds upon the Essentials tier, focusing on elevated security needs. It includes all Essentials features plus threat protection capabilities against suspicious login activity, detection of compromised credentials, risk-based adaptive authentication, and the ability to export user authentication event logs for threat analysis.
- Availabilityย โ The Essentials and Plus tier are available in all AWS Regions whereย Amazon Cognito is availableย except AWS GovCloud (US) Regions.
- Free tier on Lite and Essentials tiersย โ Customers on the Lite and Essentials tiers can enjoy the free tier each month that does not automatically expire. It is available to both existing and new AWS customers indefinitely. For more details on free tier, please visit theย Amazon Cognito pricingย page.
- Extended pricing benefit for existing customersย โ Customers are eligible to upgrade their user pools without advanced security features (ASF) in their existing accounts to Essentials and pay the same price as Cognito user pools until November 30, 2025. To be eligible, customersโ accounts must have had at least 1 monthly active user (MAU) in the last 12 months on or before 10:00am Pacific Time, November 22, 2024. These customers are also eligible to create new user pools with Essentials tier at the same price as Cognito users pools in those accounts until November 30, 2025.
โ Donnie
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.