> Reading Cognito docs feels like someone took three separate manuals, threw them in a blender, and then sprinkled in some outdated Stack Overflow answers for flavor.
This is my experience with basically all of AWS documentation. It is nearly always either (1) far too high-level to be of any actual use, or (2) far too verbose, with a massive volume of superfluous information I need to parse and discard before I get to the stuff I am trying to figure out.
That’s my experience with any of the 3 hyperscalers when reading docs. Millions of versions, blog posts and just overall massive challenge to get to the root of it. Funny the one thing I was always able to immediately and quickly digest, AWS Textract because they have a great python library with the kind of documentation I expect from a python project.
My experience with Boto: need some S3 manipulation logic, here is an official documentation that shows how to solve the exact problem with Boto, one caveat, this version of Boto is deprecated. Do the same with the newest version? Not possible.
> That’s my experience with any of the 3 hyperscalers when reading docs.
I used to hate the AWS docs, now I use Azure and I hate that so much more. At least AWS had loads of (bad) docs that you could string together to figure out how to do something. With Azure, there's just no docs (except for bad videos), and they literally tell you (at the top of every page) that you can do this with AI (I know I can do it with AI, but I'd prefer if I could read your docs to make sure the machine isn't doing something dumb).
My expectation is that I'll end up on GCP in a few years, and that will be bad in hilariously different ways.
They get promoted for fucking with them. We were in the middle of a big fight with Microsoft support over a product defect. They literally updated the product docs in realtime and revised the sizing guidance for the product to be about 5% under our sizing. It was too specific a number to be a coincidence.
We were at war with them, so the team was capturing the documentation and timestamping it. They gaslit us to run the clock so the product would slide outside of mainstream support.
I always say that AWS docs are exhaustive, but exhausting. Mostly because they're spread across half a dozen places. The answer you need is normally in there somewhere, but good luck finding it. And when I remember the docs contain some fact I want re-reference, I can never find it again.
My experience with Cognito matches the author's experience exactly. I mostly used Auth0 in the past, but we switched to Cognito for a new project because it would be cheaper.
Don't like that email addresses are case sensitive, and now you want to change that? Sorry, you gotta create a new user pool from scratch--no way to migrate.
That’s really the worst feature of it. When you first set it up you’re asked at least a dozen questions that you probably have no idea what they mean. But you have to pick something. And whatever you pick on that first day setup you are stuck with FOREVER. Unless you do a complex data migration task.
Also, want to migrate to a different provider? Sorry. You can’t get the hashed passwords out. So if you do a migration it will be painful to users since they’ll have to do a password reset.
Ory Kratos has a password migration hook that lets you migrate password credentials out of anything (including Cognito) without password resets.
I believe most other (modern) auth vendors have an equivalent.
I really don't see any reason to be using Cognito in $currentyear.
> Next time, I’m picking a tool based on developer experience first, not AWS service integration convenience. The time we lost debugging Cognito issues could have paid for several years of a paid auth provider.
How many paid auth providers let you export user password hashes so that you can seamlessly migrate to another vendor, if you want to?
The whole problem with auth is that both (a) login screens are shown to unauthenticated users, which is a superset that includes attackers, who will do everything from DDoS to crafted malicious input to try to grab user secrets, so you really want to pick something that is already running at large production scale and with all the production battle-scars, and (b) that need to go with a managed vendor is very much in tension against local development, vendor independence, data portability, and other Good Engineering Practices (TM).
Sure, AWS Cognito sucks. In many ways, the product feels stuck. Making compromises to get stuff shipped, working, and stable sucks. But honestly, unless you're going to prefer (b) over (a) (and there are times to do so, in particular with intranet applications behind a firewall that aren't really susceptble to those kinds of attacks) and pick something like Keycloak, you could do a lot worse than Cognito (shudder, Okta, shudder).
Counter point: How many paid auth providers force you to create an entirely new deployment and then use a lambda to migrate within their own system? Especially for something as seemingly simple like adding another metadata field?
I think they allow export because they drew some interesting lines around their own mutability concerns.
Auth0 and Firebase both let you export user password hashes (though I believe you need to open a support ticket in order to do it in Auth0's case at least).
I think Cognito is actually one of the few with absolutely no path to achieving this.
Yup for the Ory managed service (Ory Network) you can export all data through the admin API including hashed passwords.
Of course when self-hosting Ory you have full control over the database as well.
Don't even get me started on backups or other basic functionality one would expect from a service like this. AWS should either make an acquisition (Auth0 or a smaller company like Wristband?) and rebuild the service, or just kill it. Instead, we have a critical service that enterprises rely on stuck in limbo...
Yeah good example of this also with the agent stuff they are pushing now, documentation can read to be sales-like and then as you start using it stuff starts to fall apart. At this point there are better open source alternatives (self-hosting) for pretty much anything not requiring specialized hardware
I share the OP's pain we chose to use cognito for the exact same reason and I've had the exact same pain however the evaluation of itself takes time and the inconvenience OP is suffering with is only a function of having users.
If I were starting my startup again I would, in almost every instance, trade problems if we have some success for reduced decision fatigue at the start.
Regardless of AI gen'd article... Cognito does have some rough edges. One day I'd like to make a best practices Cloudformation template (if doesn't already exist) that includes things like which login name to set, notification lambdas and the like.
This may now mean something along the lines of "struggling to grind through..." but is based on the original meaning of having sex without a condom, typically with misogynist overtones. You might want to avoid it for this style of writing and audience.
AWS documentation is the best excuse to stay away from their services. I thank everyday for their documents, it's like putting a lighthouse on an iceberg.
I've used AWS Cognito for two start ups. One is still trucking. Cognito definitely leaves a lot to be desired, but overall I've never encountered any major issues with it. I think it's cheap precisely bc it's lackluster, but that's fine for my needs. YMMV I guess
I built a product on Cognito in 2017-18 or when it was, and already back then it felt semi-abandonded. Thankfully that particular product never really took off and we didn't have to spend too much time on wrangling Cognito.
This is so weird because AI should be good at updating the docs.
And yet, I often think this about things which still suck even though AI is good at them. Like why is Siri so bad still. Why do so many basic things in windows 11 not work, like folder search? Why does Altium or anything by Xilinx always have outdated docs that refer to menus that dont exist anymore?
I’ve been pondering a deep dive into Keycloak or Ory. Or is WorkOS good enough for the price?
I’m looking to centralize account management across multiple systems.
Feels like there are a few categories of services from cloud providers,
There’s the basic infrastructure we know and love like S3, EC2, etc.
There’s the higher level but still basic stuff that just makes a lot of sense. I like ECS + Fargate, Lambda, DynamoDB, SQS.
And then there are the tarpits. CloudFormation. Cognito. Step Functions. API Gateway. They do something useful (otherwise why would they exist?) but the main point of their existence seems to be to trap you in AWS, and the fact that they solve a problem seems secondary. Some of them are cheap (CloudFormation is free!) but in general they seem like expensive alternatives to simpler, cheaper solutions.
Just use whatever service that costs 10x as much to make it do what it was advertised to do in the first place, like DAX for dynamo or cloudfront for S3 in case you hit “scale” like 2000 req/sec
... or those who don't know about constant-time functions, the difference between sha1 and argon2, etc. etc.
I had to fix such things several times in corporate internet-facing systems. A generalist engineer can do this just fine, if they're aware of the state of the art, but there's nothing ensuring that they actually do. The compliance tickboxes were of no help here either.
At least it's formatted readably and they took the time to ask the AI to make it less AI-like. The tone is annoying but I try to focus on the message and not how it's communicated.
You'd think making AI do the annoying integration work would mean less complaints about terrible docs and API.
This is a terrible suggestion. Rolling your own auth nowadays is like rolling your own encryption. It’s just a bad idea. OAuth and OIDC are massive specs that are constantly changing and you’re going to be stuck chasing and developing auth instead of your actual product.
I know because this is what my brain dead principal engineer did and I’ve spent the last 3 years chasing RFCs and am now going to spend the next year migrating to Keycloak because I’ve finally convinced my boss that we’re not an auth company.
> Reading Cognito docs feels like someone took three separate manuals, threw them in a blender, and then sprinkled in some outdated Stack Overflow answers for flavor.
This is my experience with basically all of AWS documentation. It is nearly always either (1) far too high-level to be of any actual use, or (2) far too verbose, with a massive volume of superfluous information I need to parse and discard before I get to the stuff I am trying to figure out.
As just one example, I recently needed to link an AWS Partner Central account with an AWS Management account, and process and documentation was painfully complicated: https://docs.aws.amazon.com/partner-central/latest/getting-s...
That’s my experience with any of the 3 hyperscalers when reading docs. Millions of versions, blog posts and just overall massive challenge to get to the root of it. Funny the one thing I was always able to immediately and quickly digest, AWS Textract because they have a great python library with the kind of documentation I expect from a python project.
My experience with Boto: need some S3 manipulation logic, here is an official documentation that shows how to solve the exact problem with Boto, one caveat, this version of Boto is deprecated. Do the same with the newest version? Not possible.
> That’s my experience with any of the 3 hyperscalers when reading docs.
I used to hate the AWS docs, now I use Azure and I hate that so much more. At least AWS had loads of (bad) docs that you could string together to figure out how to do something. With Azure, there's just no docs (except for bad videos), and they literally tell you (at the top of every page) that you can do this with AI (I know I can do it with AI, but I'd prefer if I could read your docs to make sure the machine isn't doing something dumb).
My expectation is that I'll end up on GCP in a few years, and that will be bad in hilariously different ways.
GCP is famous for having two ways to do everything: the undocumented way and the deprecated way. You choose.
Yes, gcp has volumes of available accurate documentation, but it's almost entirely incomprehensible and bizarrely undiscoverable by search
No one gets promoted for writing good docs.
They get promoted for fucking with them. We were in the middle of a big fight with Microsoft support over a product defect. They literally updated the product docs in realtime and revised the sizing guidance for the product to be about 5% under our sizing. It was too specific a number to be a coincidence.
We were at war with them, so the team was capturing the documentation and timestamping it. They gaslit us to run the clock so the product would slide outside of mainstream support.
Documentation clearly following Conway's law: shipping the org chart.
I always say that AWS docs are exhaustive, but exhausting. Mostly because they're spread across half a dozen places. The answer you need is normally in there somewhere, but good luck finding it. And when I remember the docs contain some fact I want re-reference, I can never find it again.
My experience with Cognito matches the author's experience exactly. I mostly used Auth0 in the past, but we switched to Cognito for a new project because it would be cheaper.
Don't like that email addresses are case sensitive, and now you want to change that? Sorry, you gotta create a new user pool from scratch--no way to migrate.
That’s really the worst feature of it. When you first set it up you’re asked at least a dozen questions that you probably have no idea what they mean. But you have to pick something. And whatever you pick on that first day setup you are stuck with FOREVER. Unless you do a complex data migration task.
Also, want to migrate to a different provider? Sorry. You can’t get the hashed passwords out. So if you do a migration it will be painful to users since they’ll have to do a password reset.
Yes it’s cheap. But you get what you pay for.
Ory Kratos has a password migration hook that lets you migrate password credentials out of anything (including Cognito) without password resets. I believe most other (modern) auth vendors have an equivalent.
I really don't see any reason to be using Cognito in $currentyear.
Disclosure: working for Ory.
> Next time, I’m picking a tool based on developer experience first, not AWS service integration convenience. The time we lost debugging Cognito issues could have paid for several years of a paid auth provider.
How many paid auth providers let you export user password hashes so that you can seamlessly migrate to another vendor, if you want to?
The whole problem with auth is that both (a) login screens are shown to unauthenticated users, which is a superset that includes attackers, who will do everything from DDoS to crafted malicious input to try to grab user secrets, so you really want to pick something that is already running at large production scale and with all the production battle-scars, and (b) that need to go with a managed vendor is very much in tension against local development, vendor independence, data portability, and other Good Engineering Practices (TM).
Sure, AWS Cognito sucks. In many ways, the product feels stuck. Making compromises to get stuff shipped, working, and stable sucks. But honestly, unless you're going to prefer (b) over (a) (and there are times to do so, in particular with intranet applications behind a firewall that aren't really susceptble to those kinds of attacks) and pick something like Keycloak, you could do a lot worse than Cognito (shudder, Okta, shudder).
Counter point: How many paid auth providers force you to create an entirely new deployment and then use a lambda to migrate within their own system? Especially for something as seemingly simple like adding another metadata field?
I think they allow export because they drew some interesting lines around their own mutability concerns.
I also would never use cognito again.
https://docs.aws.amazon.com/cognito/latest/developerguide/co...
Auth0 and Firebase both let you export user password hashes (though I believe you need to open a support ticket in order to do it in Auth0's case at least).
I think Cognito is actually one of the few with absolutely no path to achieving this.
Ory let's you do this I believe.
Yup for the Ory managed service (Ory Network) you can export all data through the admin API including hashed passwords. Of course when self-hosting Ory you have full control over the database as well.
Disclosure: working for Ory.
Don't even get me started on backups or other basic functionality one would expect from a service like this. AWS should either make an acquisition (Auth0 or a smaller company like Wristband?) and rebuild the service, or just kill it. Instead, we have a critical service that enterprises rely on stuck in limbo...
Auth0 already was acquired.
Yeah good example of this also with the agent stuff they are pushing now, documentation can read to be sales-like and then as you start using it stuff starts to fall apart. At this point there are better open source alternatives (self-hosting) for pretty much anything not requiring specialized hardware
I share the OP's pain we chose to use cognito for the exact same reason and I've had the exact same pain however the evaluation of itself takes time and the inconvenience OP is suffering with is only a function of having users.
If I were starting my startup again I would, in almost every instance, trade problems if we have some success for reduced decision fatigue at the start.
Regardless of AI gen'd article... Cognito does have some rough edges. One day I'd like to make a best practices Cloudformation template (if doesn't already exist) that includes things like which login name to set, notification lambdas and the like.
One big pro about cognito.. can't beat the price.
They added new enterprise features, free ride is over if you want any improvements made to the service in the last 8 years.
>> and even rawdogged a custom JWT system ...
This may now mean something along the lines of "struggling to grind through..." but is based on the original meaning of having sex without a condom, typically with misogynist overtones. You might want to avoid it for this style of writing and audience.
"sucks" was originally a homophobic pejorative. Languages evolve, sometimes very rapidly.
The article it's written by Reddit trained AI what do you expect?
One greenfield project I worked on our AWS rep specifically told us to avoid Cognito and go towards auth0 or whatever else.
On another project people didn't get this advice and we spent a two weeks working around the limitations to scrap it eventually.
I had the same learnings with cognito when using it for a product we built.
We mainly choose it because AWS was used anyway and the security aspect seemed to be solved entierly with this coice (if aws get's hacked ... ).
We regretted it out of similar reasons.
AWS documentation is the best excuse to stay away from their services. I thank everyday for their documents, it's like putting a lighthouse on an iceberg.
I've used AWS Cognito for two start ups. One is still trucking. Cognito definitely leaves a lot to be desired, but overall I've never encountered any major issues with it. I think it's cheap precisely bc it's lackluster, but that's fine for my needs. YMMV I guess
I built a product on Cognito in 2017-18 or when it was, and already back then it felt semi-abandonded. Thankfully that particular product never really took off and we didn't have to spend too much time on wrangling Cognito.
Friends don't let friends use AWS Cognito.
> That’s not an upgrade. That’s a hostage situation.
This is so weird because AI should be good at updating the docs.
And yet, I often think this about things which still suck even though AI is good at them. Like why is Siri so bad still. Why do so many basic things in windows 11 not work, like folder search? Why does Altium or anything by Xilinx always have outdated docs that refer to menus that dont exist anymore?
LDAP, or...
Linux/BSD as the identity/runtime layer, SSH is the protocol boundary, and your web backend is the command gateway.
I’ve been pondering a deep dive into Keycloak or Ory. Or is WorkOS good enough for the price? I’m looking to centralize account management across multiple systems.
Used all 3, I would go with Ory.
Just out of interest, what makes you choose Ory over Keycloak/WorkOs?
WorkOS is incredible, even if you don't need any of the "enterprise" features and you're building an entirely B2C app.
AWS is mental health hazard, has been for many years.
cannot believe in the age of AI, they still couldn't fix the docs issue.
Feels like there are a few categories of services from cloud providers,
There’s the basic infrastructure we know and love like S3, EC2, etc.
There’s the higher level but still basic stuff that just makes a lot of sense. I like ECS + Fargate, Lambda, DynamoDB, SQS.
And then there are the tarpits. CloudFormation. Cognito. Step Functions. API Gateway. They do something useful (otherwise why would they exist?) but the main point of their existence seems to be to trap you in AWS, and the fact that they solve a problem seems secondary. Some of them are cheap (CloudFormation is free!) but in general they seem like expensive alternatives to simpler, cheaper solutions.
I caution against using DynamoDB when just starting out. It’s too easy to paint yourself into a corner.
Just use whatever service that costs 10x as much to make it do what it was advertised to do in the first place, like DAX for dynamo or cloudfront for S3 in case you hit “scale” like 2000 req/sec
Nobody is ever going to convince me AWS isn’t hostile to users as a filter
Like how scammers put in typos
It’s not for users it’s for people who think 1/4 of the traffic a raspberry pi could handle is scale. Or don’t know what a server is.
... or those who don't know about constant-time functions, the difference between sha1 and argon2, etc. etc. I had to fix such things several times in corporate internet-facing systems. A generalist engineer can do this just fine, if they're aware of the state of the art, but there's nothing ensuring that they actually do. The compliance tickboxes were of no help here either.
This reads like, and is confirmed by Pangram to be, 100% AI slop
At least it's formatted readably and they took the time to ask the AI to make it less AI-like. The tone is annoying but I try to focus on the message and not how it's communicated.
You'd think making AI do the annoying integration work would mean less complaints about terrible docs and API.
"That’s not an upgrade. That’s a hostage situation."
hah that quote makes my day.
Why use any AWS for a startup?
Why use AWS for any size company?
IMHO not rolling your own auth is asking for stuff like this to happen.
This is a terrible suggestion. Rolling your own auth nowadays is like rolling your own encryption. It’s just a bad idea. OAuth and OIDC are massive specs that are constantly changing and you’re going to be stuck chasing and developing auth instead of your actual product.
I know because this is what my brain dead principal engineer did and I’ve spent the last 3 years chasing RFCs and am now going to spend the next year migrating to Keycloak because I’ve finally convinced my boss that we’re not an auth company.