AWS Cognito

Cognito is used for givin users an identity in oder to being able to communicate with a system
Cognito offers 3 products:
- Cognito User Pools:
  - Sign in functionality for the app users
  - Integrates with API Gateway
- Cognito Identity Pool (Federated Identity):
  - Provides AWS credentials to users which want to access AWS resources directly
  - Integrates with Cognito User Pools as an identity provider
- Cognito Sync:
  - Used for synchronize data from a device to Cognito
  - Deprecated, replaced by AppSync

AWS Cognito User Pools

It is a serverless database for users of an application
it is a simple login provider: username (or email) / password combination
Possibility to verify emails/phone numbers and add MFA
Can enable Federated Identities (Facebook, Google, SAML, etc.). This is not the same CIP (AWS Federated Identity)!
Sends back a JSON Web Token (JWT)
Can be integrated with API Gateway for authentication

Goal:
- Provide direct access to AWS resources from the client side
How:
- Log in to a federated identity provider - or remain anonymous
- Get temporary AWS credentials from the Federated Identity Pool
- These credentials come with pre-defined IAM policies stating their permissions
Examples:
- Provide temporary access to write to a S3 bucket using Facebook login

Deprecated - use AWS AppSync
Can be used for cross device synchronization from any platform: iOS, Android, etc.
It provides some offline capabilities, synchronization will happen when the device will come online
Requires Federated Identity Pool in Cognito (not User Pool!)
Data is stored in datasets, each dataset can have up to 1MB of data. We can have up to 20 datasets to synchronize