Identity
User pool, providers, sign-up, recovery, MFA, passkeys, and verification.
Browser-local planning aid · Source checked August 9, 2026
Define the Cognito boundary before an agent changes it
Choose the client, protected resource, sign-in method, and execution mode. Get an architecture path, prompt, safety gates, and tests—not generated infrastructure or an AWS change.
Recommended architecture
User pool → JWT → backend API
Use a user pool for sign-in and issue tokens to the SPA. The API validates the expected token and applies scopes plus application-specific authorization. No identity pool is required for this path.
Agent prompt
For Customer portal, inventory the current Cognito and API authorization state without changing it. Treat the browser SPA as a public client with no client secret. Plan managed login with authorization code and PKCE for the application's own backend API. Separate user-pool, authorizer, application-code, IAM, and agent-permission responsibilities. Show account, Region, resource scope, preserved fields, full-replacement operations, tests, rollback, and approval gates.
Exact account, Region, pool, client, domain, and callback scope
Full field diff for replacement-style updates
Allowed, denied, expiry, revocation, and recovery tests
Approval, rollback, audit, and incident owner
Nothing is sent to AWS. Do not paste credentials, tokens, client secrets, production user data, or unredacted account identifiers into this planner or an agent prompt.
Review by layer
Five boundaries, five separate checks
Client
Public or confidential type, redirect URLs, grant, scopes, and secret handling.
Resource
JWT authorizer, backend rules, identity pool, IAM role, and resource policy.
Agent
Read and write authority, account and Region scope, approvals, and secrets.
Evidence
Diff, tests, denied paths, rollback, CloudTrail, logs, and human owner.
Continue by decision
Cognito auth planner questions
It creates a browser-local architecture summary, agent prompt, review gates, and test checklist from your client, resource path, sign-in method, and execution mode.
No. It does not access an AWS account, inspect existing pools, call the Agent Toolkit, store credentials, generate infrastructure, or apply changes.
Add an identity pool when the client must obtain temporary AWS credentials to call AWS services directly. A client that signs in and calls only your backend usually needs a user pool, not an identity pool.
Yes, after removing sensitive identifiers and adapting it to your environment. Keep the first pass read-only and require account, Region, resource, permission, change-diff, test, and rollback review before writes.
Official references: AWS aws-auth launch, Agent Toolkit quick start, and Amazon Cognito developer guide. Verify current commands, clients, Regions, feature plans, APIs, limits, prices, and IAM guidance.