The Confusion
These two services have similar names and are often used together, but they solve completely different problems. Conflating them is one of the most common mistakes in AWS identity design.
| Dimension | Cognito User Pool | Cognito Identity Pool |
|---|---|---|
| What it does | Authenticates users (who are you?) | Authorizes AWS access (what can you do?) |
| Output | JWT (ID Token, Access Token, Refresh Token) | Temporary AWS Credentials |
| Understands | Usernames, passwords, MFA, social login | Tokens from any identity provider |
| Used by | Your API Gateway, your application backend | AWS SDK calls from client apps |
| Analogy | Passport control (proves identity) | Key vending machine (issues access keys) |
When to Use Each
User Pool only: You have a web app with a backend API. Users log in, get a JWT, and your API Gateway validates the JWT on every request. You never need AWS credentials on the client side.
Identity Pool only: You have a trusted backend system (e.g., a corporate SAML IdP) and you want to grant its users direct AWS access without building a user directory in Cognito.
Both together (most common): Mobile or single-page app where users log in via User Pool, then exchange the JWT for AWS credentials via Identity Pool to access S3, DynamoDB, or other services directly from the client.