The Missing Link
Think of AWS services like a secure office building where every door requires a specific keycard format. Cognito User Pools give you a JWT — a digital ID badge that proves who you are. But the doors in this building (S3, DynamoDB, Lambda) only accept a completely different format: AWS Access Keys signed with SigV4. Your JWT is valid, but it's the wrong shape for the lock.
Cognito Identity Pools (also called Federated Identities) is the machine in the lobby that reads your ID badge and prints out the right keycard format. It does not authenticate you — that already happened. It exchanges your existing proof of identity for the credentials AWS services actually accept.
- Input: A token from any supported identity provider — Cognito User Pools, Google, Facebook, Apple, SAML, or even a custom developer-authenticated identity.
- Output: Temporary AWS credentials: an Access Key ID, a Secret Access Key, and a Session Token, valid for up to 1 hour by default.
This separation of concerns is intentional. Authentication (who are you?) is handled by the identity provider. Authorization (what AWS resources can you touch?) is handled by Identity Pools via IAM roles. Neither system needs to know the internals of the other.