With Amazon Cognito, you pay only for what you use. There are no minimum fees and no upfront commitments. Amazon Cognito charges for identity management and data synchronization, and the pricing for these features are shown below.
Free Tier
Amazon Cognito user pools has a free tier. The free tier does not automatically expire at the end of your 12 month AWS Free Tier term, and it is available to both existing and new AWS customers indefinitely. Please note - the free tier pricing isn’t available for user pool local or federated users in the AWS GovCloud (US-West) region.
- For users who sign in directly or through a social identity provider, Amazon Cognito user pools has a free tier of 50,000 MAUs per account or per AWS organization.
- For users federated through SAML 2.0 or an OpenID Connect (OIDC) identity provider, Amazon Cognito user pools has a free tier of 50 MAUs per account or per AWS organization.
- There is no free tier for app clients or token requests when Cognito is used for the machine-to-machine use case.
-
Amazon Cognito user pools
-
Higher API RPS quotas
-
Machine-to-machine authorization
-
Amazon Cognito Sync
-
Amazon Cognito user pools
-
You pay for Amazon Cognito user pools based on your monthly active users (MAUs). A user is counted as a MAU if, within a calendar month, your app generates an identity operation for that user, like administrative creation or update, sign-up, sign-in, sign-out, token refresh, password change, a user account attribute update, or an attribute query on a user (AdminGetUser API). You are not charged for subsequent sessions or for inactive users within that calendar month.
There is separate pricing for users who sign in directly with their credentials from a user pool (includes social identity providers) and for users who sign in through an enterprise directory with SAML federation.
Advanced Security FeaturesAdvanced security features include compromised credentials detection, adaptive authentication, advanced security metrics, and access token customization. If you enable advanced security features for Amazon Cognito, additional prices apply for monthly active users as shown in the table below. This includes audit mode. **Advanced security features isn't available in the AWS GovCloud (US-West) region**.
The prices for the advanced security features for Amazon Cognito are in addition to the base prices for active users. For example, if you enable these advanced security features for a user pool with 100,000 monthly active users, your monthly bill would be $275 for the base price for active users ($0.0055 per MAU past the 50,000 free tier) plus $4,250 for the advanced security features ($0.05 per MAU for the first 50,000 plus $0.035 per MAU for the next 50,000) for a total of $4,525.
SMS messages for Multi-Factor Authentication (MFA)
Separate pricing applies for sending SMS messages for Multi-Factor Authentication (MFA), user registration, password recovery, and phone number verification. Amazon Cognito uses Amazon Simple Notification Service (SNS) to send SMS messages, and you can reference Amazon SNS pricing.
Email messages for user verification
Separate pricing applies for sending email messages for user registration, password recovery, and email address verification. Amazon Cognito uses Amazon Simple Email Service (SES) to send email messages, and you can reference Amazon SES pricing.
Migrating Existing User Directories to Amazon Cognito user pools
Many organizations may have existing infrastructure for managing user identities, authentication and authorization, but maintaining and supporting these systems and keeping them up to date with evolving best security practices can be costly and time consuming.
Amazon Cognito identity pools
Use of Amazon Cognito identity pools for authenticating users and generating unique identifiers is provided at no charge.
-
Higher API RPS quotas
-
You can request higher requests per second (RPS) rates in Amazon Cognito for the API categories defined in the table below. To request increased quotas for one or more API categories, or for more information on the individual APIs in each API category, please refer to the documentation. Quota increases are subject to approval by AWS.
The prices for higher quotas are in addition to the base prices for monthly active users and any other features including Advanced Security Features. Minimum duration for higher quotas is 1 day.
Prices are per 1 RPS of incremental capacity over default quotas per month. Each API Category is charged separately. For example, if you need an ongoing increment in quota for the User Authentication of 20 RPS indefinitely:
Monthly Cost = 20 RPS * (1 Mo) * $20 per RPS-Mo = $400.
On the other hand, if you need a partial month quota increase of 20 RPS for 7 days of a 30-day month:
One-time Cost = 20 RPS * (7/30) Mo * $45 per RPS-Mo = $210
-
Machine-to-machine authorization
-
Amazon Cognito supports machine-to-machine (M2M) use cases using the OAuth 2.0 specification’s client credentials flow. You can use Amazon Cognito to set up your service (software or an API service represented as an “app client”), establish the app client credentials, and issue access tokens in exchange for these credentials (known as token requests). These access tokens can then be used to communicate with your services. You can configure the validity of the access token for each service. You can also determine token usage per app client.
Amazon Cognito charges you along two dimensions for the M2M authorization usage. You are charged monthly per app client, prorated by the second. You are also charged monthly per token request.
* Please contact your account team if you require over 2,500 app clients.
PRICING EXAMPLES
Example 1: You have 10 app clients and each app client makes 500 requests a month. Each app client was used throughout the month. Your account in US East (N. Virginia) Region.
Total number of token requests in a month
- 500 requests x 10 app clients = 5,000 monthly token requests
Total number of app clients in a month
- 10 app clients
Total cost of M2M authorization
- $0.00225 x 5,000 token requests = $11.25 per month for token requests
- $6.00 x 10 app clients = $60.00 for app clients per month
Total cost = $71.25 per month
---
Example 2: You have 200 app clients. One hundred app clients each make 2,500 requests per month and the other 100 app clients each make 6,500 requests per month. All 200 app clients are used throughout the month.
Total number of token requests in a month
- 2,500 requests x 100 app clients = 250,000 monthly token requests
- 6,500 requests x 100 app clients = 650,000 monthly token requests
Total number of app clients in a month
- 200 app clients
Total cost of M2M authorization
- ($0.00225 x 250,000 token requests) + ($0.0015 x 650,000 token requests) = $562.50 + $975.00 = $1,537.50 per month for token requests
- ($6.00 per app client x 100 app clients) + ($3.00 x 100 app clients) = $600 + $300 = $900 for app clients per month
Total cost = $2,437.50 per month
---
Example 3: You have 1,050 app clients across all your accounts. Forty app clients are used as part of automation templates and get created for 1 hour before being deleted. These app clients cumulatively make 1 million token requests in a month.
Total number of token requests in a month
- 1M monthly token requests
Total number of app clients in a month
- 40 app clients used for 1 hour each in the month
- 1,010 app clients used for the complete month.
Total cost of M2M authorization
- ($0.00225 x 250,000 token requests) + ($0.0015 x 750,000 token requests) = $562.50 + 1125 = $1,687.50 per month for token requests
- $6.00 x (40 x [30 days /24 hours per day]) + $6.00 per app client x 60 app clients + $3.00 x 400 app clients + $1.5 x 510 app clients = $0.33 + $360 + $1,200 + $765 = $2,325.33 for app clients per month
Total cost = $4,012.83 per month
---
Q: Why is Amazon Cognito pricing for a machine-to-machine (M2M) use case?
A: Amazon Cognito supports an OAuth 2.0 client credentials flow, which can help secure machine-to-machine interactions. Amazon Cognito offers support for an M2M capability and it is being priced to better support continued growth and expand capabilities.
Q: Is there any change to Amazon Cognito pricing for monthly active users?
A: No, there is no change to Amazon Cognito’s pricing for monthly active users (MAUs).
Q: When will the Amazon Cognito pricing change for M2M support take effect?
A: This pricing change will not take effect until July 9, 2024. On and after July 9, 2024, you will be charged for your use of the M2M capability, unless you are using Amazon Cognito’s M2M capabilities under an exempted customer account.
Q: Which customer accounts are exempted from the pricing change and for how long?
A: Any AWS account that is configured for use with Amazon Cognito M2M before 12:01 AM UTC, May 9, 2024, the day of the pricing announcement, will be exempt from pricing until May 9, 2025. The exemption will be at the AWS account ID level. If your AWS account had an Amazon Cognito user pool configured for machine-to-machine use (OAuth 2.0 client credentials flow with a confidential app client) before May 9, 2024, then that AWS account will be exempt from pricing until May 9, 2025. Any new AWS account IDs and payer ids created and configured for Amazon Cognito’s M2M capabilities will not be charged until July 9, 2024.
Q: Which customer accounts will not be exempted from the pricing change, and when will these non-exempted accounts be charged for M2M use?
A: Any AWS account that starts using Amazon Cognito M2M for the first time on or after May 9, 2024, will not be charged for this feature until July 9, 2024, but will not be eligible for the 12-month exemption. After July 9, 2024, Amazon Cognito M2M usage for these accounts will be billed at standard pricing. Please note that this will apply even if you have other accounts that are eligible for the 12-month exemption.
Q: What specific usage will not be priced in the exempted accounts?
A: Any customer accounts that were already using Amazon Cognito M2M prior to May 9, 2024, will be exempt from pricing until May 9, 2025. This will apply to all M2M app clients and to token requests made to these app clients in the exempted accounts. We will exempt new M2M app clients created in these accounts after the launch of pricing until May 9, 2025. Both token requests and app clients in these accounts will be payable starting May 9, 2025.
Q: Can non-exempted customer accounts request to be added to the 12-month exemption?
A: No, non-exempted customer accounts cannot be added to the exemption.
Q: Can exempted customer accounts request an extension of the 12-month exemption?
A: No, we do not plan to extend the exemption beyond 12 months.
Q: What will my bill look like?
A: Customers who use this feature will see their current usage of token requests in each of their accounts in their bill. New app clients created will also appear in the bill. The existing app clients will show up in their bill once we complete data backfill.
-
Amazon Cognito Sync
-
