alt Hacker NewsI used AWS cognito for a startup. I wouldn't do it again
Comments
> Next time, I’m picking a tool based on developer experience first, not AWS service integration convenience. The time we lost debugging Cognito issues could have paid for several years of a paid auth provider.
How many paid auth providers let you export user password hashes so that you can seamlessly migrate to another vendor, if you want to?
The whole problem with auth is that both (a) login screens are shown to unauthenticated users, which is a superset that includes attackers, who will do everything from DDoS to crafted malicious input to try to grab user secrets, so you really want to pick something that is already running at large production scale and with all the production battle-scars, and (b) that need to go with a managed vendor is very much in tension against local development, vendor independence, data portability, and other Good Engineering Practices (TM).
Sure, AWS Cognito sucks. In many ways, the product feels stuck. Making compromises to get stuff shipped, working, and stable sucks. But honestly, unless you're going to prefer (b) over (a) (and there are times to do so, in particular with intranet applications behind a firewall that aren't really susceptble to those kinds of attacks) and pick something like Keycloak, you could do a lot worse than Cognito (shudder, Okta, shudder).
My experience with Cognito matches the author's experience exactly. I mostly used Auth0 in the past, but we switched to Cognito for a new project because it would be cheaper.
Don't like that email addresses are case sensitive, and now you want to change that? Sorry, you gotta create a new user pool from scratch--no way to migrate.
I remember talking to the Cognito team about password reset and arguing with them that being able to set a password was a required feature. They were like "no, why would you never have to not go through the reset flow? That's a security problem." Then of course they added it in a few weeks later because every admin needs to do that. So at some point they had a bunch of people working on it who had like zero operational experience.
Two benefits to Cognito are (1) it allows you to log into a service without having any credentials locally, and (2) that Cognito identity allows you to provide access to AWS resources. You can probably do that now, but plenty of solutions still require an on-device key...which is an obvious security issue.
Also, using your own backend for authentication made it easier to manage things because your auth wasn't trapped inside Cognito.
Cognito has real rough edges, this article doesn't really mention any of them.
If you've ever tried to implement, say, a working SAML integration through Cognito, you'll know how obscure the flow is. I've had to work with the Cognito team to get real showstopping bugs fixed.
Definitely not AWS's most polished service, but workable if you know the ins and outs.
Don't even get me started on backups or other basic functionality one would expect from a service like this. AWS should either make an acquisition (Auth0 or a smaller company like Wristband?) and rebuild the service, or just kill it. Instead, we have a critical service that enterprises rely on stuck in limbo...
I don't disagree that AWS Cognito isn't the easiest auth service to work with, but once you figure it out, it works just as well as the others.
I've experienced the same exact pains (and many more) that the author described. But the thing is that once you've experienced those pains, you know how to deal with them. In software, you just have to figure it out once and then it's done.
I can't say I scaled Cognito usage to anything massive, but I can say that keeping everything in AWS is worth the hassle (at least depending on the context). Cognito provides plenty of options of actual customization (the hosted UI is only good for initial testing, then toss it). And, of course, LLMs are able to deal with Cognito just as easily as any other auth service. I didn't have the luxury of using LLMs when I set up Cognito, but it's still my go-to for auth and Claude doesn't stumble on it.
Personally I would never build my business on a technology tied to a specific vendor that makes it difficult to switch if said vendor delivers a poor service or massively raises the price.
The documentation complaint is true of many, maybe all, AWS services: they discuss multiple generations, address multiple target audiences, and range wildly in currency and relevance, from marketing material to technical deep dives, all intermixed.
Cognito itself is a very AWS tradeoff. It's delightfully inexpensive. It quite effectively protects one of the most relentlessly attacked parts of any web service. It supports workflows essential as you scale, like SAML federation ("single sign on/SSO"). It basically works, day in and day out.
But OMG, the sharp edges! It has sharp edges to spare, even compared to other AWS services, for which sharp edges and exposed corners are just par for the course.
Then you try to go the next step, e.g. add multi-region disaster recovery and failover. That seemingly straightforward requirement to scale up is "left as an exercise for the reader."
Cognito has all the virtues of a utility service, including the developer experience.
Keycloak and Ory are the only providers I would actually endorse, and I've used just about all of them.
Cognito is a pain, but it mostly works once you get through their horrible docs.
Auth0 is a vendor locked PoS with a very aggressive sales team.
Regardless of AI gen'd article... Cognito does have some rough edges. One day I'd like to make a best practices Cloudformation template (if doesn't already exist) that includes things like which login name to set, notification lambdas and the like.
One big pro about cognito.. can't beat the price.
AWS documentation is the best excuse to stay away from their services. I thank everyday for their documents, it's like putting a lighthouse on an iceberg.
I share the OP's pain we chose to use cognito for the exact same reason and I've had the exact same pain however the evaluation of itself takes time and the inconvenience OP is suffering with is only a function of having users.
If I were starting my startup again I would, in almost every instance, trade problems if we have some success for reduced decision fatigue at the start.
The thing is beyond like top 10 AWS services(ec2, s3, sqs, aurora and few more) this is how most of AWS is. It’s just stuff thrown at the wall to see if it sticks.
I wouldn’t be surprised if median AWS service does less than 100k in annual revenue
I've used AWS Cognito for two start ups. One is still trucking. Cognito definitely leaves a lot to be desired, but overall I've never encountered any major issues with it. I think it's cheap precisely bc it's lackluster, but that's fine for my needs. YMMV I guess
for Auth - why don't people go with trusted solutions that work without hiccups.
if you want hosted setups - FusionAuth, Stytch etc.
if you work in a mainstream language/framework - some excellent libraries eg in ruby authentication-zero, in js - BetterAuth, Django-all-auth.
for AWS as well - use their solutions where you don't need to read a lot of docs.
One greenfield project I worked on our AWS rep specifically told us to avoid Cognito and go towards auth0 or whatever else.
On another project people didn't get this advice and we spent a two weeks working around the limitations to scrap it eventually.
I did some work for a sizable org who were pursuing a migration from their in-house auth to cognito. They originally scoped it at two months, and it ended up taking them six to roll it out.
Then they figured out that their cost projection was actually off by an order of magnitude. And also kept getting bitten by peripheral systems newly getting out of sync.
And so then, they embarked upon the journey to roll it all back...
I had the same learnings with cognito when using it for a product we built.
We mainly choose it because AWS was used anyway and the security aspect seemed to be solved entierly with this coice (if aws get's hacked ... ).
We regretted it out of similar reasons.
I built a product on Cognito in 2017-18 or when it was, and already back then it felt semi-abandonded. Thankfully that particular product never really took off and we didn't have to spend too much time on wrangling Cognito.
AWS is good at operations, i.e. running something like S3 at massive scale. Or SQS, ddb, etc. High surface area for distributed systems, but low surface area for user experience.
Once you add in product decision making, like how to make the dev experience good on something with alot of user flows (like cognito), the products are shit.
Friends don't let friends use AWS Cognito.
Yeah good example of this also with the agent stuff they are pushing now, documentation can read to be sales-like and then as you start using it stuff starts to fall apart. At this point there are better open source alternatives (self-hosting) for pretty much anything not requiring specialized hardware
LDAP, or...
Linux/BSD as the identity/runtime layer, SSH is the protocol boundary, and your web backend is the command gateway.
In a previous greenfield project (pre-LLM) I considered using Cognito since I was all-in on AWS (Lambda, DynamoDB, ApiG, Route53, S3, SQS/SNS, and the list goes on...) but after reading through the docs I wanted to pull my hair out. What I thought was going to be a time-saving measure turned into a quagmire. Even with my level of "lock in" I was not willing to hand over auth and so I rolled my own (and it worked fine).
Nowadays I can't imagine using a 3rd-party for something like auth (or many other things) due to lock-in and also just always needing to conform to their way of doing things.
Apologies for the non-sequitur but 2 days ago I saw FreshDesk had deleted my account (free plan) that I had been using (sparingly, <50 tickets total if I had to guess) for 3+ years. No email, no notice, just deleted my account and broke the sites that I had integrated their feedback widget into. I reached out to see what was going on and they pretty much told me I had to upgrade if I wanted my account back.
Now 1-2 years ago I would have considered paying. In fact I would have considered paying IF they had contacted me to say "pay up or we will delete" but the fact they deleted it without any contact meant FreshDesk was dead to me. I started, for all of 1 minute, to consider the alternatives before I fired up Claude and in <2hrs I had a full replacement for all the parts of FreshDesk I was using (basic ticketing, emails, statuses, file upload).
The build-vs-buy decision has completely flipped for me. I have a hard time thinking of paying for something my platform depends on, especially auth, when it's so easy to build it now.
Side Note: that "all-in" AWS project? Yeah, with Claude's help I'm off 90% of the AWS's services and while it's still hosted there I can move to any VPS if I want now that I've removed my dependencies on AWS-specific concepts. It's been glorious and it has the side effect of meaning my local dev more-closely matches the deployed code since there isn't AWS-magic I have to fake anymore.
how are these claude written blogs consistently making front page?
I’ve been pondering a deep dive into Keycloak or Ory. Or is WorkOS good enough for the price? I’m looking to centralize account management across multiple systems.
For those that don't use AWS Cognito, what's the next best alternative these days? (Don't say Auth0 either)
AWS is mental health hazard, has been for many years.
I am going to be that guy.
8/10 times, you don't need these 3rd party providers. Yes, someone is going to tell me all about the SSOs, SCIMs, Audit Logs etc etc but the point is that 8/10 applications are simple enough to build their own Auth. The rest, go for these services. I never understood the appeal of these 3rd party providers who can hold you hostage just for your users to login ? In 2026 ? I don't get it. May be I am dumb.
I both hate and love Cognito. Hate it for its unnecessary complexity, love it for providing auth at bargain bin prices. I review Auth0 contracts frequently and that is daylight robbery/extortion, a poster child for vendor-lock-in. I had hopes for clerk.dev, but unfortunately the auth business optimizes for deep lock-in + steadily escalating prices.
After working through a few transitions to/from Auth0 that is something I never ever want to do again at scale.
Feels like there are a few categories of services from cloud providers,
There’s the basic infrastructure we know and love like S3, EC2, etc.
There’s the higher level but still basic stuff that just makes a lot of sense. I like ECS + Fargate, Lambda, DynamoDB, SQS.
And then there are the tarpits. CloudFormation. Cognito. Step Functions. API Gateway. They do something useful (otherwise why would they exist?) but the main point of their existence seems to be to trap you in AWS, and the fact that they solve a problem seems secondary. Some of them are cheap (CloudFormation is free!) but in general they seem like expensive alternatives to simpler, cheaper solutions.
I'll be sad when AI gets advanced enough that we can't immediately detect it in writing. For now the slop remains pretty easy to spot.
cannot believe in the age of AI, they still couldn't fix the docs issue.
Why not keycloak?
This reads like, and is confirmed by Pangram to be, 100% AI slop
This is so weird because AI should be good at updating the docs.
And yet, I often think this about things which still suck even though AI is good at them. Like why is Siri so bad still. Why do so many basic things in windows 11 not work, like folder search? Why does Altium or anything by Xilinx always have outdated docs that refer to menus that dont exist anymore?
Just use whatever service that costs 10x as much to make it do what it was advertised to do in the first place, like DAX for dynamo or cloudfront for S3 in case you hit “scale” like 2000 req/sec
I used to be an architect with a bag of pro certifications for the world's largest AWS services provider/developer/reseller (we even did a lot of work for Amazon.com themselves). I gave it up a few years ago when it became clear that for most people, moving OUT of the cloud was a far better move than moving IN.
In a lot of ways, I really love AWS, but most of the high-value services are increasingly flaky and questionably supported, and nearly all of them have (often not very obvious) lock-in barbs.
For a while, cloud native development actually made sense. But as Cloud services have converged to become just big Kubernetes providers with API sprinkles (whose syntax is often more vinegary than sugary), there is less and less value there.
Add to that that almost no companies really need a huge cloud-based system to run their businesses, and that $500-2500 computers literally outstrip the performance of supercomputers from around the turn of the century in every respect, and there is less and less real need for cloud services...
Nobody is ever going to convince me AWS isn’t hostile to users as a filter
Like how scammers put in typos
Why use any AWS for a startup?
Why use AWS for any size company?
[dead]
[flagged]
[dead]
[dead]
[dead]
[flagged]
> Reading Cognito docs feels like someone took three separate manuals, threw them in a blender, and then sprinkled in some outdated Stack Overflow answers for flavor.
This is my experience with basically all of AWS documentation. It is nearly always either (1) far too high-level to be of any actual use, or (2) far too verbose, with a massive volume of superfluous information I need to parse and discard before I get to the stuff I am trying to figure out.
As just one example, I recently needed to link an AWS Partner Central account with an AWS Management account, and process and documentation was painfully complicated: https://docs.aws.amazon.com/partner-central/latest/getting-s...