Amazon Cognito gives you unique identifiers for your end users and then lets you securely store and sync user app data in the AWS Cloud across multiple devices and OS platforms. You can do this with just a few lines of code, and your app can work the same, regardless of whether a user’s devices are online or offline. When new data is available in the sync store, a user’s devices can be alerted by a silent push notification so that your app can sync the new data automatically.
You can use Amazon Cognito directly from your mobile app without building or maintaining any backend infrastructure. Amazon Cognito handles secure app data storage and sync, enabling you to focus on your app experiences, instead of the heavy lifting of creating and managing a user data sync solution.
Amazon Cognito also makes it simple to implement AWS security best practices. Amazon Cognito provides your app with a set of temporary, limited-privilege AWS credentials for each app user that can be used to access other AWS services, such as Amazon S3 or Amazon DynamoDB. This means your app can access the resources it needs to provide users a great experience, and you don’t have to hardcode security credentials in your app.
Get Started with AWS for Free
Create a Free AccountAWS Free Tier offers unlimited user authentication and ID generation, 10 GB of cloud sync storage and 1 million sync operations per month with Amazon Cognito.
You can use the optional Amazon Cognito client SDKs to automatically create a local data store to cache user app data on the device. This means your app can keep reading and writing data regardless of the device connectivity state. If you save user app data while a device is offline, it can easily be synced as soon as connectivity is restored, without affecting the user’s experience.
When you use the AWS Mobile SDK to integrate Amazon Cognito with your app, data is read from and written to the local data store. You have to explicitly call the synchronize method to push the application data to the Amazon Cognito sync store in the AWS Cloud. This gives you full control over your sync operations and the cost associated with them.
With Amazon Cognito there are two ways to access your sync store data. You can use the Cognito APIs or the Cognito console to read and write sync store data on a per-identity basis. You can also enable Cognito Streams. With Cognito Streams you can push all of the data as a Kinesis stream in your AWS account. You can then consume the stream and store this data for analysis in a storage or database of your choice. Cognito provides a sample Kinesis Consumer Application for storing the data in Amazon Redshift.
With Amazon Cognito you can easily synchronize app data across all of an end user’s devices. Amazon Cognito manages the complexity of conflict resolution and intermittent network connectivity so that your app can always deliver a great user experience. Each data set in the Amazon Cognito sync store can be synchronized on all devices associated with an identity by making a single API call. Devices can also be notified of changes to the sync store with silent push notifications.
Your app users can start off as unauthenticated guests, as they might do when they first try an app. Amazon Cognito allows you to securely store and sync data, such as application settings, to the cloud for these users even though they have not logged in. If a user later decides to authenticate with one of the supported public login providers, Amazon Cognito makes it easy for you to preserve their data (such as app settings, or the level they have reached in a game) so that your users have a seamless experience throughout their usage of your application.
When you use Amazon Cognito, the service takes care of all the steps necessary to create a unique identifier for your app’s users and retrieve temporary, limited privilege AWS credentials. This means that you can follow security best practices, and use these temporary, limited privilege credentials instead of having to hardcode credentials into your app. You can use these credentials to allow your app to access other AWS resources, such as Amazon S3 or Amazon DynamoDB. These temporary, limited-privilege credentials can be used regardless of whether the user is an unauthenticated guest or is authenticating with one of the supported public login providers. When you access other AWS resources using credentials provided by Amazon Cognito, regular AWS charges for those services will apply.
You can use the unique user identifiers that Amazon Cognito generates in your access policies to enable or restrict access to other AWS resources on a per-user basis. For example, if you use the unique identifier generated by Amazon Cognito as a variable in your access policies, you could restrict access to a folder within an Amazon S3 bucket to a particular app end user, making it easy for you to control access to your other AWS resources.
