Cognito - User Sub is not longer a valid UUID

Question

I've just created a new User Pool and noticed that Cognito is now generating what "appears" to be a UUID v7 Sub.
Upon validating this UUID though, its not a valid UUID as it fails to variant check.

It should be characters 8 - a, however it seems to be random.

Example of previous Cognito UUID v4 - 000444c3-11bb-4296-903c-ae0e51e9d64b

Example of new Cognito "UUID v7" - 197e34f8-a0a1-7004-43ff-98fa5e2a412d

Notice the third group starts with a 7, indicating this is a v7 UUID.
However, the forth group is required to start with a character 8 - b (ie. 8, 9, a or b) and you can see the example above uses a 4

Just trying to understand what is going on and how to use it?

Trevor Schiavone · Answer

Hi Patrick,
The [Terms and concepts page of the Cognito documentation](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-terms.html#terms-uuid) suggests that UUIDs in Cognito don't follow any specific format. 
You can use the `sub` claim as a unique identifier, however I wouldn't recommend using the only the `sub` on its own as an identifier in external systems. In the event you ever needed to migrate users to a different user pool or IDP (e.g. migrating to a different region) you would potentially lose those mappings since new `sub` attributes would be generated for the users in a new system.

cjuega · Answer

It's kind of annoying not being able to validate that the given uuid is indeed valid. Using standard tools like uuid fail to validate AWS Cognito's uuids because of this.

@patrick, have you figured out a workaround to this?

Cognito - User Sub is not longer a valid UUID

Add your answer

Relevant content