Cognito splits its price by tier, feature and login method

The workload

Amazon Cognito is the identity service bundled into AWS's own ecosystem: a user directory and authentication server a founder wires up alongside whatever else runs on AWS. It replaces the same workload Auth0, Clerk and WorkOS replace elsewhere in this batch, sign-up, session issuance, federation with identity providers, but bills through the same account as the rest of an AWS bill. Amazon's own developer guide, retrieved 16 September 2026, describes a user pool as "a user directory with both self-service and administrator-driven user creation, management, and authentication," a verified description of the service.

What the documents show

Cognito's own pricing page states a verified free-tier allowance of "10,000 monthly active user (MAU) per month per account or per AWS organization" across its Essentials and Lite tiers, with a smaller allowance of "50 MAUs per month" for SAML or OIDC federation regardless of tier. Above that, pricing splits into three tiers: Lite prices direct sign-in or social-provider MAUs at $0.0055 each up to 90,000 MAUs and $0.0046 above that; Essentials prices the same at $0.015; Plus prices them at $0.020 but folds in advanced security features Lite prices as a separate add-on. The developer guide confirms, as a second verified source, that security monitoring against malicious activity and insecure passwords is a named feature of user pools generally, a detail it states exists but does not price, leaving the pricing page as the only source for the dollar figure.

The operating cost

The Lite-tier advanced security add-on is verified at $0.05 per MAU for the first 50,000 MAUs using it, stepping down to $0.035 for the next 50,000, and $0.02 above 100,000, separate from the base authentication charge. SAML and OIDC federation costs $0.015 per MAU on every tier, including Lite, where it does not benefit from that tier's lower base rate. AWS states these as per-account or per-organization allowances rather than per-application, so multiple apps under one account share a single free-tier pool, a structural difference from the per-application allowances the other vendors in this batch state.

The stop condition

The documents name the free-tier boundary at 10,000 MAUs, or 50 for federation, as the point charges begin, and 90,000 MAUs on Lite as the point its rate drops. No document states a cancellation trigger beyond these thresholds; editorially, a founder already paying for AWS elsewhere may treat the stop condition as whichever tier's total cost, security included, beats a standalone vendor's equivalent bundle, a comparison this entry does not run.

• Does the app need SAML or OIDC federation, priced the same across every tier regardless of the base rate?
• Is the advanced security feature worth its add-on price on Lite, or does Plus's bundled rate cost less at this volume?
• Does the free tier apply per application, or is it shared with other apps under the same AWS account?

Cognito's tiered, feature-gated pricing is a fourth distinct model in this batch, priced in the same per-MAU unit as Auth0 but split by tier and security-feature inclusion in a way none of the other three vendors document.