One greenfield project I worked on our AWS rep specifically told us to avoid Cognito and go towards auth0 or whatever else.

On another project people didn't get this advice and we spent a two weeks working around the limitations to scrap it eventually.