What's the difference between Amazon Cognito user pools and identity pools?

Short description

User pools are for authentication. Your app users can sign in through the user pool, or federate through a third-party identity provider (IdP). Identity pools are for authorization. You can use identity pools to create unique identities for users, and give them access to other AWS services.

Resolution

User pool use cases

Use a user pool in the following scenarios:

• Design sign-up and sign-in webpages for your app.
• Access and manage user data.
• Track your user device, location, and IP address, and adapt to sign-in requests of different risk levels.
• Use a custom authentication flow for your app.

Identity pool use cases

Use an identity pool in the following scenarios:

• Give your users access to AWS resources, such as an Amazon Simple Storage Service (Amazon S3) bucket or an Amazon DynamoDB table.
• Generate temporary AWS credentials for unauthenticated users.

For more example use cases, see Common Amazon Cognito scenarios.

Related information

Identity pools concepts (federated identities)

Identity pools (federated identities) authentication flow

Features of Amazon Cognito