- Newest
- Most votes
- Most comments
Hello, can you describe what you're looking to achieve in a little more detail? It sounds like you want to store only the the sub attribute for a user, and then be able to query their full details using that identifier. The sub attribute is the unique identifier for each user.
This should be achievable using the ListUsers API together with the sub as a filter.
You describe this in your question, is there a reason this approach isn't sufficient?
answered 2 years ago
AWS Cognito doesn't have a direct method to retrieve user information using the user ID. The workarounds include using the ListUsers method with a filter for the specific user ID, or the GetUser method with an Access Token.
https://docs.aws.amazon.com/cognito/latest/developerguide/how-to-manage-user-accounts.html
Relevant content
- AWS OFFICIALUpdated 4 months ago
Sorry for the very late reply. Let's say for argument that Cognito user pools are implemented as a multi-tenant setup in DDB. That would mean that the user pool ID is the partition key, and let's be optimistic and assume that there is an index with a sort key on the sub field and that when DDB Query is called with a partition key and sort key of the index, it would binary search for the specific entry. Searching for a user by their sub using ListUsers will have latency or read usage that scales with the log of the number of users in the best case.
Continuing, if a cognito admin wants to avoid storing PII (i.e. usernames) and needs to describe a specific user, they cannot use Cognito alone without potential scaling issues, and have to supplement with another data store of their own.
I wouldn't recommend making an assumption about the backend architecture and related performance or scalability of a service without testing, however depending on what data specifically you're looking to access, have you considered passing the user information in the tokens as an alternative? Maintaining an external data store is also quite common, especially for frequently changing data or in situations where attributes may not conform with Cognito custom attribute limitations, though understandably it may not be possible for your use case.