Amazon Cognito
A service that adds sign-up, sign-in, and access control to web and mobile apps.
Amazon Cognito provides authentication, authorization, and user management for web and mobile apps without custom identity code. It uses two constructs: a User Pool, a managed directory handling sign-up, sign-in, and multi-factor authentication for app users, and an Identity Pool, which exchanges a token for temporary AWS credentials so users can call AWS services directly. The exam distinction is scope: Cognito governs end-user identity (customers logging into your app), while IAM governs workforce and service identity (who operates AWS resources). If a scenario describes adding login to a mobile app or federating with Google or Active Directory, the answer is Cognito, not IAM.
PlayPrepHQ study notes are written and reviewed against primary exam sources. How we create & review content →