Amazon Cognito Pricing

You pay for Amazon Cognito user pools based on your monthly active users (MAUs). A user is counted as a MAU if, within a calendar month, your app generates an identity operation for that user, like administrative creation or update, sign-up, sign-in, token refresh, password change, or a user account attribute update. You are not charged for subsequent sessions or for inactive users within that calendar month.

There is separate pricing for users who sign in directly with their credentials from a user pool and for users who sign in through an enterprise directory with SAML federation.

Amazon Cognito user pools has a free tier of 50,000 MAUs per account for users who sign in directly to Amazon Cognito user pools and 50 MAUs for users federated through SAML 2.0 based identity providers. The free tier does not automatically expire at the end of your 12 month AWS Free Tier term, and it is available to both existing and new AWS customers indefinitely. Please note - the free tier pricing isn’t available for user pool local or federated users in the AWS GovCloud (US-West) region.

Users who sign in directly with their user pool credentials or with social identity providers:

For users who sign in directly with their user pool credentials or with social identity providers such as Apple, Google, Facebook and Amazon, there are volume-based pricing tiers for MAUs above the free tier, as shown in the table below.

The prices for the advanced security features for Amazon Cognito are in addition to the base prices for active users. For example, if you enable these advanced security features for a user pool with 100,000 monthly active users, your monthly bill would be $275 for the base price for active users ($0.0055 per MAU past the 50,000 free tier) plus $4,250 for the advanced security features ($0.05 per MAU for the first 50,000 plus $0.035 per MAU for the next 50,000) for a total of $4,525.

SMS messages for Multi-Factor Authentication

Separate pricing applies for sending SMS messages for Multi-Factor Authentication (MFA) and phone number verification. Amazon Cognito uses Amazon Simple Notification Service (SNS) to send SMS messages, and you can reference Amazon SNS pricing.

Use of Amazon Cognito identity pools for authenticating users and generating unique identifiers is provided at no charge.

Migrating Existing User Directories to Amazon Cognito user pools:

Many organizations may have existing infrastructure for managing user identities, authentication and authorization, but maintaining and supporting these systems and keeping them up to date with evolving best security practices can be costly and time consuming.