Nobody is ever going to convince me AWS isn’t hostile to users as a filter
Like how scammers put in typos
_3u10 · 2026-08-28 13:58:41 UTC
It’s not for users it’s for people who think 1/4 of the traffic a raspberry pi could handle is scale. Or don’t know what a server is.
_3u10 · 2026-08-28 13:56:18 UTC
Just use whatever service that costs 10x as much to make it do what it was advertised to do in the first place, like DAX for dynamo or cloudfront for S3 in case you hit “scale” like 2000 req/sec
turboturbo · 2026-08-28 13:56:29 UTC
This reads like, and is confirmed by Pangram to be, 100% AI slop
justinluther · 2026-08-28 13:57:44 UTC
"That’s not an upgrade. That’s a hostage situation."
chasd00 · 2026-08-28 14:00:15 UTC
hah that quote makes my day.
wilkystyle · 2026-08-28 14:00:42 UTC
> Reading Cognito docs feels like someone took three separate manuals, threw them in a blender, and then sprinkled in some outdated Stack Overflow answers for flavor.
This is my experience with basically all of AWS documentation. It is nearly always either (1) far too high-level to be of any actual use, or (2) far too verbose, with a massive volume of superfluous information I need to parse and discard before I get to the stuff I am trying to figure out.
Regardless of AI gen'd article... Cognito does have some rough edges. One day I'd like to make a best practices Cloudformation template (if doesn't already exist) that includes things like which login name to set, notification lambdas and the like.
One big pro about cognito.. can't beat the price.
arpinum · 2026-08-28 14:09:39 UTC
They added new enterprise features, free ride is over if you want any improvements made to the service in the last 8 years.
pelagicAustral · 2026-08-28 14:03:23 UTC
AWS documentation is the best excuse to stay away from their services. I thank everyday for their documents, it's like putting a lighthouse on an iceberg.
mikigraf · 2026-08-28 14:05:20 UTC
Don't even get me started on backups or other basic functionality one would expect from a service like this. AWS should either make an acquisition (Auth0 or a smaller company like Wristband?) and rebuild the service, or just kill it. Instead, we have a critical service that enterprises rely on stuck in limbo...
patwolf · 2026-08-28 14:06:44 UTC
My experience with Cognito matches the author's experience exactly. I mostly used Auth0 in the past, but we switched to Cognito for a new project because it would be cheaper.
Don't like that email addresses are case sensitive, and now you want to change that? Sorry, you gotta create a new user pool from scratch--no way to migrate.
opengrass · 2026-08-28 14:06:50 UTC
LDAP, or...
Linux/BSD as the identity/runtime layer, SSH is the protocol boundary, and your web backend is the command gateway.
solatic · 2026-08-28 14:10:58 UTC
> Next time, I’m picking a tool based on developer experience first, not AWS service integration convenience. The time we lost debugging Cognito issues could have paid for several years of a paid auth provider.
How many paid auth providers let you export user password hashes so that you can seamlessly migrate to another vendor, if you want to?
The whole problem with auth is that both (a) login screens are shown to unauthenticated users, which is a superset that includes attackers, who will do everything from DDoS to crafted malicious input to try to grab user secrets, so you really want to pick something that is already running at large production scale and with all the production battle-scars, and (b) that need to go with a managed vendor is very much in tension against local development, vendor independence, data portability, and other Good Engineering Practices (TM).
Sure, AWS Cognito sucks. In many ways, the product feels stuck. Making compromises to get stuff shipped, working, and stable sucks. But honestly, unless you're going to prefer (b) over (a) (and there are times to do so, in particular with intranet applications behind a firewall that aren't really susceptble to those kinds of attacks) and pick something like Keycloak, you could do a lot worse than Cognito (shudder, Okta, shudder).
goosejuice · 2026-08-28 14:12:47 UTC
[delayed]
badrequest · 2026-08-28 14:11:22 UTC
IMHO not rolling your own auth is asking for stuff like this to happen.
Comments
Like how scammers put in typos
This is my experience with basically all of AWS documentation. It is nearly always either (1) far too high-level to be of any actual use, or (2) far too verbose, with a massive volume of superfluous information I need to parse and discard before I get to the stuff I am trying to figure out.
As just one example, I recently needed to link an AWS Partner Central account with an AWS Management account, and process and documentation was painfully complicated: https://docs.aws.amazon.com/partner-central/latest/getting-s...
One big pro about cognito.. can't beat the price.
Don't like that email addresses are case sensitive, and now you want to change that? Sorry, you gotta create a new user pool from scratch--no way to migrate.
Linux/BSD as the identity/runtime layer, SSH is the protocol boundary, and your web backend is the command gateway.
How many paid auth providers let you export user password hashes so that you can seamlessly migrate to another vendor, if you want to?
The whole problem with auth is that both (a) login screens are shown to unauthenticated users, which is a superset that includes attackers, who will do everything from DDoS to crafted malicious input to try to grab user secrets, so you really want to pick something that is already running at large production scale and with all the production battle-scars, and (b) that need to go with a managed vendor is very much in tension against local development, vendor independence, data portability, and other Good Engineering Practices (TM).
Sure, AWS Cognito sucks. In many ways, the product feels stuck. Making compromises to get stuff shipped, working, and stable sucks. But honestly, unless you're going to prefer (b) over (a) (and there are times to do so, in particular with intranet applications behind a firewall that aren't really susceptble to those kinds of attacks) and pick something like Keycloak, you could do a lot worse than Cognito (shudder, Okta, shudder).