AWS Cognito keys rotation frequency

Question

I am using Cognito JWKS URI `https://cognito-idp..amazonaws.com//.well-known/jwks.json` to get public keys.
In this service, it is a simple passthrough of the data from this URL to the client.

I want to add a cache there. In the [documentation](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html), it is stated that keys are sometimes rotated but I cannot find any information on how often this happens.

Is there any more conclusive information on how often these keys are rotated?

Answer

I don't think that is documented anywhere.
We used Cognito for years and can't remember them ever being rotated. I would say it's safe to cache for at least 24hours or even more. But it's very hard to say.

AWS Cognito keys rotation frequency

Relevanter Inhalt