aws-cognito-idp

Create a new user pool

$ aws cognito-idp create-user-pool --pool-name [my-pool]

$ aws cognito-idp admin-create-user --user-pool-id [pool-id] --username [user@example.com]

$ aws cognito-idp list-users --user-pool-id [pool-id]

$ aws cognito-idp admin-initiate-auth --user-pool-id [pool-id] --client-id [client-id] --auth-flow ADMIN_USER_PASSWORD_AUTH --auth-parameters USERNAME=[username],PASSWORD=[password]

$ aws cognito-idp create-user-pool-client --user-pool-id [pool-id] --client-name [my-app]

$ aws cognito-idp admin-set-user-password --user-pool-id [pool-id] --username [user@example.com] --password [NewPassword123!] --permanent

$ aws cognito-idp admin-add-user-to-group --user-pool-id [pool-id] --username [user@example.com] --group-name [admins]

aws cognito-idp command [options]

aws cognito-idp is the AWS CLI interface for Amazon Cognito User Pools, a user directory service for web and mobile app authentication. It handles user registration, authentication, account recovery, and integration with external identity providers like Google, Facebook, and SAML-based systems.
Cognito User Pools provides features including multi-factor authentication, password policies, email/SMS verification, and OAuth 2.0 token issuance. It can be used for both server-side administration and client-side user flows.

create-user-pool

Create a new user pool

Create a user as an administrator

Delete a user from the pool

List users in a user pool

Start server-side authentication

Respond to authentication challenges (MFA, new password)

Set or reset a user's password

Create a user group

Add a user to a group

Create an app client for authentication

User pool configuration cannot be changed after creation for some settings like username attributes. Tokens issued by Cognito have a maximum lifetime of 24 hours for access tokens. Custom authentication lambdas add latency to sign-in flows. SMS-based MFA incurs additional SNS charges.

Amazon Cognito User Pools launched in July 2016 as a managed user directory. It built upon Cognito Identity (federated identities) which launched in 2014. Advanced security features including adaptive authentication were added in 2017, and WebAuthn/passkey support was introduced in 2023.

aws(1), aws-cognito-identity(1), aws-iam(1)