SAA-C03
Deep Dive
Cognito solves the problem of "how do I authenticate users in my web or mobile app without managing my own identity server". It shows up in SAA-C03 in B2C application scenarios, direct access to AWS services from mobile, and federation with external providers like Google or Facebook.
Contents
A User Pool is a user directory managed by AWS. It provides sign-up, login, MFA, password recovery and email/phone verification without needing to build or maintain identity infrastructure.
After a successful authentication, Cognito returns three JWT tokens: ID Token (user data), Access Token (permissions in the User Pool) and Refresh Token (renewing the previous two).
Federation with external IdPs
A User Pool can act as an identity broker: Google, Facebook, Apple, any SAML or OIDC provider. The user logs in with their social account and Cognito returns a normalized JWT.
Lambda Triggers
Hooks that run at points in the user lifecycle: pre-signup (validate email domain), post-confirmation (create a profile in DynamoDB), pre-token-generation (add custom claims to the JWT).
ALB integration
An Application Load Balancer can authenticate users directly using a Cognito User Pool as the IdP. The ALB validates the JWT and only forwards authenticated traffic to the target group — no code in the app.
API Gateway integration
API Gateway supports a native Cognito Authorizer: it validates the User Pool JWT automatically on every request, with no need to implement a custom Lambda Authorizer.
Exam trap
A User Pool authenticates app users and returns a JWT — but those tokens do not grant direct access to AWS services (S3, DynamoDB, etc.). For that you need an Identity Pool. User Pool ≠ AWS access.
An Identity Pool (Federated Identities) delivers temporary AWS credentials to authenticated users, or even to unauthenticated (guest) users. Internally it calls STS AssumeRoleWithWebIdentity and returns a short-lived access key, secret key and session token.
Supported identity sources
Cognito User Pool (the most common case on the exam)
Google, Facebook, Apple, Amazon — direct social login without a User Pool
SAML 2.0 / OpenID Connect — corporate providers
Unauthenticated (guest) users — receive credentials tied to a limited-access IAM Role
Not the same as IAM Identity Center — an Identity Pool is for external users of your app, not company employees
Authenticated user → IAM Role with full access
The Identity Pool maps the authenticated user to an IAM Role with the necessary permissions (e.g. s3:PutObject in their own S3 folder).
Unauthenticated (guest) user → IAM Role with limited access
The Identity Pool assigns a second IAM Role with minimal permissions. Useful for apps that allow reading public content without login.
Exam trap
Identity Pool ≠ User Pool. The User Pool authenticates (who you are). The Identity Pool authorizes access to AWS (what you can do with the services). They are distinct components used together or separately.
Combining a User Pool with an Identity Pool removes the need for a backend server to manage AWS credentials. The mobile or web app can call S3, DynamoDB or any AWS service directly with short-lived credentials.
User logs in to the User Pool
The app sends email + password (or starts OAuth with Google). Cognito User Pool validates the credentials and returns an ID Token JWT.
App sends the JWT to the Identity Pool
The app calls the Identity Pool API, presenting the User Pool JWT as proof of identity.
Identity Pool validates with the User Pool and calls STS
The Identity Pool verifies the JWT signature against the User Pool and calls AWS STS with AssumeRoleWithWebIdentity.
STS returns temporary AWS credentials
STS issues an access key, secret key and session token with a configured duration (between 15 minutes and 12 hours). The Identity Pool forwards them to the app.
App uses the credentials to call AWS services
The app can now call S3 PutObject, DynamoDB GetItem, etc. directly with those temporary credentials — with no intermediate server involved.
ALB + User Pool
The ALB can authenticate requests directly against the User Pool. It redirects the user to the Cognito login page, validates the JWT on every request and only passes authenticated traffic to the target group — with no authentication code in the app.
API Gateway + User Pool
API Gateway has a native Cognito Authorizer: it extracts the JWT from the Authorization header, validates it against the User Pool, and rejects requests with an invalid or expired token. Simpler than a custom Lambda Authorizer for this use case.
S3 + Identity Pool
Fine-grained access: the Identity Pool's IAM Role can include a condition with the ${cognito-identity.amazonaws.com:sub} variable so each user can only read and write in their own "folder" within the S3 bucket.
External users of your app (sign-up/login)
Cognito User PoolA managed user directory with sign-up, login, MFA, password recovery and social federation.
Direct access to AWS services from the client (S3, DynamoDB)
Cognito Identity PoolDelivers temporary AWS credentials to the app. The client calls the services directly without going through a server.
Mobile app that uploads files to S3 with no backend server
User Pool + Identity PoolThe User Pool authenticates the user. The Identity Pool converts the JWT into temporary AWS credentials for S3.
Federate with Active Directory / corporate SAML for app users
User Pool as an external IdPThe User Pool acts as a SAML/OIDC broker — the user logs in with AD and Cognito returns a standard JWT.
Corporate multi-account access with SSO for employees
IAM Identity Center (not Cognito)IAM Identity Center is designed for employees and access to multiple AWS accounts. Cognito is for external application users.
User Pool = JWT, Identity Pool = temporary AWS credentials
This fundamental distinction shows up in practically every question about Cognito. The User Pool authenticates and returns JWT tokens. The Identity Pool exchanges those tokens for STS credentials to access AWS services.
Direct access to AWS from mobile always implies an Identity Pool
If the scenario describes an app that calls S3, DynamoDB or another AWS service directly from the client (with no intermediate server), the answer needs an Identity Pool — not just a User Pool.
ALB + Cognito = authentication with no code in the app
When the scenario asks for authenticating users in a web app behind an ALB without modifying the application code, the ALB + Cognito User Pool combination is the correct answer.
An unauthenticated user can receive limited credentials via an Identity Pool (guest access)
Identity Pools support unauthenticated identities. The guest IAM Role can have minimal permissions (e.g. reading public S3 objects) without the user having logged in.
IAM Identity Center is for employees/corporate accounts; Cognito is for external app users
Easy to mix up on the exam. IAM Identity Center (SSO) manages employee access to multiple AWS accounts. Cognito manages end users of B2C applications. They are not interchangeable.
Visualize both paths: JWT authentication and AWS access with temporary credentials.
Did you get this topic?
Test what you just learned
A company is building a mobile app. Users must be able to sign up with their email, log in, and the app needs to upload photos directly to a private S3 bucket with no backend server involved. Which architecture is correct?
Put what you learned to the test with original SAA-C03 exam questions.
Start SAA-C03 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.