How to design a multi-tenant Login architecture with Cognito custom domains?

Question

I need to design a multi-tenant architecture (1 user pool per tenant) in Cognito where the login UI is mapped to a [custom domain](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-add-custom-domain.html) for each tenant (eg: auth.tenant1.mydomain.com, auth.tenant2.mydomain.com etc).
As per documentation, there is a hard resource limit of [4 custom domains per account](https://docs.aws.amazon.com/cognito/latest/developerguide/limits.html)

The architecture should be scalable for 1000+ tenants. 
What are the recommendations to achieve this with the custom domain limit per account?

Thanks in advance

Answer

If you need several custom domains for each tenant, as you say, you cannot overcome the hard limit of 4.

For this reason, and to scale this, you may want to consider bypassing the Cognito login UI approach and hold it yourself with for instance Amplify in conjunction with Cognito and SAML: https://aws.amazon.com/blogs/security/use-saml-with-amazon-cognito-to-support-a-multi-tenant-application-with-a-single-user-pool/

Hope it helps

How to design a multi-tenant Login architecture with Cognito custom domains?

Relevant content