{"slug": "amazon-cognito", "name": "Amazon Cognito", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 7, "warners": 4, "score": -1.591, "rising": 0.35, "first": "2026-01-06", "latest": "2026-08-28", "why": "once you figure it out, it works just as well as the others", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 2, "neutral": 1, "compare": 0, "warn": 4}, "spark": [0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "once you figure it out, it works just as well as the others", "kind": "", "icon": true, "domain": null, "github_repo": null, "official_url": "https://aws.amazon.com/cognito/", "pricing": "", "aliases": ["AWS Cognito", "Amazon Cognito"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 791705536, "item_id": 49481596, "url": "https://news.ycombinator.com/item?id=49481596", "by": "nater5000", "date": "2026-08-28", "version": null, "stance": "recommend", "quote": "once you figure it out, it works just as well as the others", "excerpt": "I don't disagree that AWS Cognito isn't the easiest auth service to work with, but once you figure it out, it works just as well as the others. I've experienced the same exact pains (and many more) that the author described. But the thing is that once you've experienced those pains, you know how to deal with them. In software, you just have to figure it out once and then it's done. I can't say I scaled Cognito usage ", "context": "", "use_case": "authentication", "switched_from": "", "story": "I used AWS cognito for a startup. I wouldn't do it again"}, {"id": 769354738, "item_id": 48084671, "url": "https://news.ycombinator.com/item?id=48084671", "by": "nijave", "date": "2026-05-10", "version": null, "stance": "recommend", "quote": "I kind of like Cognito", "excerpt": ">AWS IAM is extremely well designed Agree, so is STS and SDKs generally just work. I don't miss on-prem companies with legacy Auth where you maintained 100 service accounts for everything with very careful password vaulting and credentials management policies. So much easier to use IAM policies. >are absolute hot garbage I kind of like Cognito but both Cognito and especially API Gateway are somewhat convoluted to con", "context": "", "use_case": "", "switched_from": "", "story": "I returned to AWS, and was reminded why I left"}, {"id": 760986608, "item_id": 47561663, "url": "https://news.ycombinator.com/item?id=47561663", "by": "raw_anon_1111", "date": "2026-03-29", "version": null, "stance": "recommend", "quote": "AWS Cognito for auth, tightly scoped IAM privileges", "excerpt": "I see you didn\u2019t say anything about the possible security issues if I was using AWS Cognito for auth, tightly scoped IAM privileges for the runtime environment and a tightly scoped database user. BTW, with AWS you can also enforce DynamoDB, Postgres and Redshift (?) to only allows rows to be accessed based on the user (IAM or Cognito) so no matter what Claude did, as long as you validate your security boundary at the", "context": "", "use_case": "user auth", "switched_from": "", "story": "The risk of AI isn't making us lazy, but making \"lazy\" look productive"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 791674832, "item_id": 49479677, "url": "https://news.ycombinator.com/item?id=49479677", "by": "leetrout", "date": "2026-08-28", "version": null, "stance": "warn", "quote": "I also would never use cognito again.", "excerpt": "Counter point: How many paid auth providers force you to create an entirely new deployment and then use a lambda to migrate within their own system? Especially for something as seemingly simple like adding another metadata field? I think they allow export because they drew some interesting lines around their own mutability concerns. I also would never use cognito again. https://docs.aws.amazon.com/cognito/latest/deve", "context": "", "use_case": "User authentication", "switched_from": "", "story": "I used AWS cognito for a startup. I wouldn't do it again"}, {"id": 791659296, "item_id": 49478706, "url": "https://news.ycombinator.com/item?id=49478706", "by": "patwolf", "date": "2026-08-28", "version": null, "stance": "warn", "quote": "My experience with Cognito matches the author's experience exactly.", "excerpt": "My experience with Cognito matches the author's experience exactly. I mostly used Auth0 in the past, but we switched to Cognito for a new project because it would be cheaper. Don't like that email addresses are case sensitive, and now you want to change that? Sorry, you gotta create a new user pool from scratch--no way to migrate.", "context": "", "use_case": "authentication", "switched_from": "Auth0", "story": "I used AWS cognito for a startup. I wouldn't do it again"}, {"id": 791657968, "item_id": 49478623, "url": "https://news.ycombinator.com/item?id=49478623", "by": "wilkystyle", "date": "2026-08-28", "version": null, "stance": "warn", "quote": "Reading Cognito docs feels like someone took three separate manuals, threw them in a blender", "excerpt": "> Reading Cognito docs feels like someone took three separate manuals, threw them in a blender, and then sprinkled in some outdated Stack Overflow answers for flavor. This is my experience with basically all of AWS documentation. It is nearly always either (1) far too high-level to be of any actual use, or (2) far too verbose, with a massive volume of superfluous information I need to parse and discard before I get t", "context": "", "use_case": "", "switched_from": "", "story": "I used AWS cognito for a startup. I wouldn't do it again"}, {"id": 744225664, "item_id": 46514104, "url": "https://news.ycombinator.com/item?id=46514104", "by": "mooreds", "date": "2026-01-06", "version": null, "stance": "warn", "quote": "the tiered pricing changes for M2M[0] in 2024 didn't make much sense to me", "excerpt": "Yeah, the tiered pricing changes for M2M[0] in 2024 didn't make much sense to me. I guess I don't understand their COGS, though. 0: https://aws.amazon.com/about-aws/whats-new/2024/05/amazon-cognito-tiered-pricing-m2m-usage/", "context": "", "use_case": "", "switched_from": "", "story": "AWS raises GPU prices 15% on a Saturday, hopes you weren't paying attention"}]}], "who": [{"by": "raw_anon_1111", "context": "Mostly deals with B2B clients with large business customers", "url": "https://news.ycombinator.com/item?id=47581694", "date": "2026-03-30"}], "tags": [], "use_cases": ["user authentication", "authentication", "user auth", "user authorization", "authentication for internal admin apps"], "compared": [{"slug": "postgresql", "name": "PostgreSQL", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "auth0", "name": "Auth0", "co": 1, "switched_from": 1, "switched_to": 0}, {"slug": "claude", "name": "Claude", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "amazon-dynamodb", "name": "Amazon DynamoDB", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49478091", "title": "I used AWS cognito for a startup. I wouldn't do it again", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=47555081", "title": "The risk of AI isn't making us lazy, but making \"lazy\" look productive", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48073201", "title": "I returned to AWS, and was reminded why I left", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47574346", "title": "The ladder is missing rungs \u2013 Engineering Progression When AI Ate the Middle", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47545748", "title": "Some uncomfortable truths about AI coding agents", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47330747", "title": "Ask HN: How do you review gen-AI created code?", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"warn": 1}, "2026-02": {}, "2026-03": {"neutral": 1}, "2026-04": {}, "2026-05": {"recommend": 1}, "2026-06": {}, "2026-07": {}, "2026-08": {"warn": 3, "recommend": 1}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "quotes": [{"id": 791705536, "item_id": 49481596, "url": "https://news.ycombinator.com/item?id=49481596", "by": "nater5000", "date": "2026-08-28", "version": null, "stance": "recommend", "quote": "once you figure it out, it works just as well as the others", "excerpt": "I don't disagree that AWS Cognito isn't the easiest auth service to work with, but once you figure it out, it works just as well as the others. I've experienced the same exact pains (and many more) that the author described. But the thing is that once you've experienced those pains, you know how to deal with them. In software, you just have to figure it out once and then it's done. I can't say I scaled Cognito usage ", "context": "", "use_case": "authentication", "switched_from": "", "story": "I used AWS cognito for a startup. I wouldn't do it again"}, {"id": 791674832, "item_id": 49479677, "url": "https://news.ycombinator.com/item?id=49479677", "by": "leetrout", "date": "2026-08-28", "version": null, "stance": "warn", "quote": "I also would never use cognito again.", "excerpt": "Counter point: How many paid auth providers force you to create an entirely new deployment and then use a lambda to migrate within their own system? Especially for something as seemingly simple like adding another metadata field? I think they allow export because they drew some interesting lines around their own mutability concerns. I also would never use cognito again. https://docs.aws.amazon.com/cognito/latest/deve", "context": "", "use_case": "User authentication", "switched_from": "", "story": "I used AWS cognito for a startup. I wouldn't do it again"}, {"id": 791659296, "item_id": 49478706, "url": "https://news.ycombinator.com/item?id=49478706", "by": "patwolf", "date": "2026-08-28", "version": null, "stance": "warn", "quote": "My experience with Cognito matches the author's experience exactly.", "excerpt": "My experience with Cognito matches the author's experience exactly. I mostly used Auth0 in the past, but we switched to Cognito for a new project because it would be cheaper. Don't like that email addresses are case sensitive, and now you want to change that? Sorry, you gotta create a new user pool from scratch--no way to migrate.", "context": "", "use_case": "authentication", "switched_from": "Auth0", "story": "I used AWS cognito for a startup. I wouldn't do it again"}, {"id": 791657968, "item_id": 49478623, "url": "https://news.ycombinator.com/item?id=49478623", "by": "wilkystyle", "date": "2026-08-28", "version": null, "stance": "warn", "quote": "Reading Cognito docs feels like someone took three separate manuals, threw them in a blender", "excerpt": "> Reading Cognito docs feels like someone took three separate manuals, threw them in a blender, and then sprinkled in some outdated Stack Overflow answers for flavor. This is my experience with basically all of AWS documentation. It is nearly always either (1) far too high-level to be of any actual use, or (2) far too verbose, with a massive volume of superfluous information I need to parse and discard before I get t", "context": "", "use_case": "", "switched_from": "", "story": "I used AWS cognito for a startup. I wouldn't do it again"}, {"id": 769354738, "item_id": 48084671, "url": "https://news.ycombinator.com/item?id=48084671", "by": "nijave", "date": "2026-05-10", "version": null, "stance": "recommend", "quote": "I kind of like Cognito", "excerpt": ">AWS IAM is extremely well designed Agree, so is STS and SDKs generally just work. I don't miss on-prem companies with legacy Auth where you maintained 100 service accounts for everything with very careful password vaulting and credentials management policies. So much easier to use IAM policies. >are absolute hot garbage I kind of like Cognito but both Cognito and especially API Gateway are somewhat convoluted to con", "context": "", "use_case": "", "switched_from": "", "story": "I returned to AWS, and was reminded why I left"}, {"id": 761307104, "item_id": 47581694, "url": "https://news.ycombinator.com/item?id=47581694", "by": "raw_anon_1111", "date": "2026-03-30", "version": null, "stance": "neutral", "quote": "these days I use Amazon Cognito", "excerpt": "As much as I get push back by saying since AI, I never look at the code and I can still be sure it meets the functional and non functional requirements, no one has been able to dispute my methodology. For functional requirements I review both the unit and more often the integration tests and make sure they align with the requirements. For security, I validate the API endpoints can\u2019t be accessed without authentication", "context": "Mostly deals with B2B clients with large business customers", "use_case": "User authentication", "switched_from": "", "story": "The ladder is missing rungs \u2013 Engineering Progression When AI Ate the Middle"}, {"id": 760986608, "item_id": 47561663, "url": "https://news.ycombinator.com/item?id=47561663", "by": "raw_anon_1111", "date": "2026-03-29", "version": null, "stance": "recommend", "quote": "AWS Cognito for auth, tightly scoped IAM privileges", "excerpt": "I see you didn\u2019t say anything about the possible security issues if I was using AWS Cognito for auth, tightly scoped IAM privileges for the runtime environment and a tightly scoped database user. BTW, with AWS you can also enforce DynamoDB, Postgres and Redshift (?) to only allows rows to be accessed based on the user (IAM or Cognito) so no matter what Claude did, as long as you validate your security boundary at the", "context": "", "use_case": "user auth", "switched_from": "", "story": "The risk of AI isn't making us lazy, but making \"lazy\" look productive"}, {"id": 760942064, "item_id": 47558879, "url": "https://news.ycombinator.com/item?id=47558879", "by": "raw_anon_1111", "date": "2026-03-28", "version": null, "stance": "neutral", "quote": "For authentication I used Amazon Cognito", "excerpt": "Please tell me how is going to be \u201chacked\u201d? A) The IAM role of the Lambda runtime it\u2019s running in is least privileged and only has access read and write access to the required S3 bucket and other required AWS services and even those are tightly scoped. B) For authentication I used Amazon Cognito and ran a curl shell script against each endpoint for authentication vs non authenticated end points C) The database user h", "context": "", "use_case": "User authentication", "switched_from": "", "story": "The risk of AI isn't making us lazy, but making \"lazy\" look productive"}, {"id": 760802610, "item_id": 47550163, "url": "https://news.ycombinator.com/item?id=47550163", "by": "raw_anon_1111", "date": "2026-03-27", "version": null, "stance": "neutral", "quote": "I used AWS Cognito for authorization", "excerpt": "What makes you think that AI couldn\u2019t make the same changes without breaking it whether you modify the code or not? And you do have automated unit tests don\u2019t you? Right now I have a 5000 line monolithic vibe coded internal website that is at most going to be used by 3 people. It mixes Python, inline CSS and Javasript with the API. I haven\u2019t looked at a line of code. My IAM permissions for the Lambda runtime has limi", "context": "", "use_case": "User authorization", "switched_from": "", "story": "Some uncomfortable truths about AI coding agents"}, {"id": 757387696, "item_id": 47336731, "url": "https://news.ycombinator.com/item?id=47336731", "by": "raw_anon_1111", "date": "2026-03-11", "version": null, "stance": "neutral", "quote": "I vibe code internal web admin apps for customers where I use AWS Cognito for authentication.", "excerpt": "My controversial opinion is I don\u2019t for the most part except for the unit and most of the time for me the integration tests and load testing I have it generate. Other than that, I review known \u201cthis works when testing but breaks in production\u201d - concurrency code, scalability issues, using the correct data load patterns, database indexes, etc. I also validate non functional requirements around security, logging, costs", "context": "architect building apps for customers", "use_case": "authentication for internal admin apps", "switched_from": "", "story": "Ask HN: How do you review gen-AI created code?"}, {"id": 757254160, "item_id": 47328385, "url": "https://news.ycombinator.com/item?id=47328385", "by": "raw_anon_1111", "date": "2026-03-10", "version": null, "stance": "neutral", "quote": "I used AWS Cognito for authentication", "excerpt": "My last project was basically an ETL implementation on AWS starting with an empty AWS account and a internal web admin site that had 10 pages. I am yada yada yadaing over a little bit. What I checked. 1. The bash shell scripts I had it write as my integration test suite 2. To make sure it wasn\u2019t loading the files into Postgres the naive way -loading the file from S3 and doing bulk inserts instead of using the AWS ext", "context": "", "use_case": "User authentication", "switched_from": "", "story": "Amazon is holding a mandatory meeting about AI breaking its systems"}, {"id": 744225664, "item_id": 46514104, "url": "https://news.ycombinator.com/item?id=46514104", "by": "mooreds", "date": "2026-01-06", "version": null, "stance": "warn", "quote": "the tiered pricing changes for M2M[0] in 2024 didn't make much sense to me", "excerpt": "Yeah, the tiered pricing changes for M2M[0] in 2024 didn't make much sense to me. I guess I don't understand their COGS, though. 0: https://aws.amazon.com/about-aws/whats-new/2024/05/amazon-cognito-tiered-pricing-m2m-usage/", "context": "", "use_case": "", "switched_from": "", "story": "AWS raises GPU prices 15% on a Saturday, hopes you weren't paying attention"}]}