What's the difference between Amazon Cognito user pools and identity pools?

Resolution

Amazon Cognito user pools are for authentication. Your app users can sign in through the user pool, or federate through a third-party identity provider (IdP). Whereas, Amazon Cognito identity pools are for authorization. You can use identity pools to create unique identities for users and grant access to other AWS services.

Example scenarios for user pools

You can use user pools for the following scenarios:

• Design sign-up and sign-in webpages for your app.
• Access and manage user attributes.
• Track your user device, location, IP address, and adapt to sign-in requests based on different risk levels.
• Create custom authentication flow for your app client, such as CAPTCHA and security questions.

Example scenarios for identity pools

You can use identity pools for the following scenarios:

• Give your users access to AWS resources through AWS Identity and Access Management (IAM) roles.
• Generate temporary AWS security credentials for unauthenticated users.

For information about identity pool concepts, see Identity pools.

FAQs

What are other scenarios for user pools and identity pools?

For example use cases, see Common Amazon Cognito scenarios.

How does authentication work with identity pools?

For information about how authentication works with identity pools, see Identity pools authentication flow.

Related information

Features of Amazon Cognito