Developer Shares AWS Cognito Authentication Struggles in Startup Project
A startup engineer's blog post detailing documentation chaos, API breaking changes, and poor developer experience with AWS Cognito sparks debate on Hacker News.
What to know
- AWS Cognito's documentation serves multiple audiences (enterprise, frontend, mobile) simultaneously, resulting in confusing, version-fragmented content that wastes developer time.
- Breaking changes in Amplify v6 required complete rewrites of working authentication code, exemplifying poor API stability for a critical service.
- Cognito's cost advantage (free up to 50,000 monthly active users) makes it attractive despite poor UX, but engineers debate whether this offsets lock-in versus rivals like Auth0 and Clerk.
- Enterprise features like SAML federation and backups have known rough edges; some commenters suggest AWS should rebuild or retire the service rather than maintain its current half-polished state.
The dispute Whether Cognito's low cost and AWS integration ultimately justify the steep learning curve, API instability, and operational pain compared to paid alternatives that command higher switching costs. · positions read across 30 posts and comments
Cognito's pain is real but acceptable tradeoff given its bargain pricing and AWS ecosystem integration once the learning curve is passed.
-
“I don't disagree that AWS Cognito isn't the easiest auth service to work with, but once you figure it out, it works just as well as the others.”
nater5000 · Hacker News
Cognito has unacceptable rough edges (SAML, backups, immutable settings) and poor documentation; engineers should avoid vendor lock-in by using alternatives or self-hosting.
-
“Cognito has real rough edges, this article doesn't really mention any of them. If you've ever tried to implement, say, a working SAML integration through Cognito, you'll know how obscure the flow is.”
cldcntrl · Hacker News ↗
AWS documentation problems are systemic across services, not unique to Cognito; the platform excels at operations but fails at user-facing product design and clarity.
-
“This is my experience with basically all of AWS documentation. It is nearly always either (1) far too high-level to be of any actual use, or (2) far too verbose, with a massive volume of superfluous information I need to parse and discard…”
wilkystyle · Hacker News
All major auth vendors (Cognito, Auth0, Clerk) create vendor lock-in; the real choice is between different types of pain and escalating costs.
-
“I review Auth0 contracts frequently and that is daylight robbery/extortion, a poster child for vendor-lock-in. I had hopes for clerk.dev, but unfortunately the auth business optimizes for deep lock-in + steadily escalating prices.”
dkobia · Hacker News
“Amplify v6 didn't just change a few method signatures. It fundamentally rearchitected how you interact with Cognito. That's not an upgrade. That's a hostage situation.”
Josh Karamuth, Startup engineer · Personal blog via Hacker News
Josh Karamuth Startup engineer, blog authorAWS Service provider
The record 1 articles and posts · last 30 days
What people are saying 24 voices from 1 site · best of 30 · verbatim
- Aug 29
-
I hated the idea of self hosting keycloak, learning how to terraform every single inch of it. But I worked at a startup that had a fucking weird investor who paid me, and would pay AWS, but wouldn't pay Okta (or any other 3rd party).So given the choice between Cognito (easy right? It's a managed service!) and Keycloak (a large, complex security…
- Aug 28
-
Most AWS docs are over-engineered marketing designed to get you to pull in 8 other billable services just to use the one you wanted in the first place.Knowing how to decipher their docs and navigate support is a resume-worthy skill.
-
The thing is beyond like top 10 AWS services(ec2, s3, sqs, aurora and few more) this is how most of AWS is. It’s just stuff thrown at the wall to see if it sticks.I wouldn’t be surprised if median AWS service does less than 100k in annual revenue
-
The documentation complaint is true of many, maybe all, AWS services: they discuss multiple generations, address multiple target audiences, and range wildly in currency and relevance, from marketing material to technical deep dives, all intermixed.Cognito itself is a very AWS tradeoff. It's delightfully inexpensive. It quite effectively protects…
-
I don't disagree that AWS Cognito isn't the easiest auth service to work with, but once you figure it out, it works just as well as the others.I've experienced the same exact pains (and many more) that the author described. But the thing is that once you've experienced those pains, you know how to deal with them. In software, you just have to…
-
I love it when I read some AWS docs to get a feel for what to do, start to build things, find something that seems like it should just work, then do a lot of digging to figure out what I'm doing wrong, only to find a slightly different page of pretty much the same documentation stating whatever I was wanting to do just isn't supported and can't be…
-
Had to go through the exact same process of linking Partner Central with Marketplace. The console suggested following multiple video tutorials and linked to docs that may be outdated.They have this AI tool on every page that links to the same content or references settings panes without linking anything.
-
Keycloak and Ory are the only providers I would actually endorse, and I've used just about all of them.Cognito is a pain, but it mostly works once you get through their horrible docs.Auth0 is a vendor locked PoS with a very aggressive sales team.
-
>It is nearly always either (1) far too high-level to be of any actual use, or (2) far too verbose, with a massive volume of superfluous information I need to parse and discard before I get to the stuff I am trying to figure out.I guess that's what they trained Opus 5 on
-
Cognito has real rough edges, this article doesn't really mention any of them.If you've ever tried to implement, say, a working SAML integration through Cognito, you'll know how obscure the flow is. I've had to work with the Cognito team to get real showstopping bugs fixed.Definitely not AWS's most polished service, but workable if you know the…
-
I both hate and love Cognito. Hate it for its unnecessary complexity, love it for providing auth at bargain bin prices. I review Auth0 contracts frequently and that is daylight robbery/extortion, a poster child for vendor-lock-in. I had hopes for clerk.dev, but unfortunately the auth business optimizes for deep lock-in + steadily escalating…
-
I remember talking to the Cognito team about password reset and arguing with them that being able to set a password was a required feature. They were like "no, why would you never have to not go through the reset flow? That's a security problem." Then of course they added it in a few weeks later because every admin needs to do that. So at some…
-
AWS is good at operations, i.e. running something like S3 at massive scale. Or SQS, ddb, etc. High surface area for distributed systems, but low surface area for user experience.Once you add in product decision making, like how to make the dev experience good on something with alot of user flows (like cognito), the products are shit.
-
In a previous greenfield project (pre-LLM) I considered using Cognito since I was all-in on AWS (Lambda, DynamoDB, ApiG, Route53, S3, SQS/SNS, and the list goes on...) but after reading through the docs I wanted to pull my hair out. What I thought was going to be a time-saving measure turned into a quagmire. Even with my level of "lock in" I was…
-
Yeah good example of this also with the agent stuff they are pushing now, documentation can read to be sales-like and then as you start using it stuff starts to fall apart. At this point there are better open source alternatives (self-hosting) for pretty much anything not requiring specialized hardware
-
>> and even rawdogged a custom JWT system ...This may now mean something along the lines of "struggling to grind through..." but is based on the original meaning of having sex without a condom, typically with misogynist overtones. You might want to avoid it for this style of writing and audience.
-
I share the OP's pain we chose to use cognito for the exact same reason and I've had the exact same pain however the evaluation of itself takes time and the inconvenience OP is suffering with is only a function of having users.If I were starting my startup again I would, in almost every instance, trade problems if we have some success for reduced…
-
I always say that AWS docs are exhaustive, but exhausting. Mostly because they're spread across half a dozen places. The answer you need is normally in there somewhere, but good luck finding it. And when I remember the docs contain some fact I want re-reference, I can never find it again.
-
That’s my experience with any of the 3 hyperscalers when reading docs. Millions of versions, blog posts and just overall massive challenge to get to the root of it. Funny the one thing I was always able to immediately and quickly digest, AWS Textract because they have a great python library with the kind of documentation I expect from a python…
-
> Next time, I’m picking a tool based on developer experience first, not AWS service integration convenience. The time we lost debugging Cognito issues could have paid for several years of a paid auth provider.How many paid auth providers let you export user password hashes so that you can seamlessly migrate to another vendor, if you want to?The…
-
My experience with Cognito matches the author's experience exactly. I mostly used Auth0 in the past, but we switched to Cognito for a new project because it would be cheaper.Don't like that email addresses are case sensitive, and now you want to change that? Sorry, you gotta create a new user pool from scratch--no way to migrate.
-
Don't even get me started on backups or other basic functionality one would expect from a service like this. AWS should either make an acquisition (Auth0 or a smaller company like Wristband?) and rebuild the service, or just kill it. Instead, we have a critical service that enterprises rely on stuck in limbo...
-
Regardless of AI gen'd article... Cognito does have some rough edges. One day I'd like to make a best practices Cloudformation template (if doesn't already exist) that includes things like which login name to set, notification lambdas and the like.One big pro about cognito.. can't beat the price.
-
> Reading Cognito docs feels like someone took three separate manuals, threw them in a blender, and then sprinkled in some outdated Stack Overflow answers for flavor.This is my experience with basically all of AWS documentation. It is nearly always either (1) far too high-level to be of any actual use, or (2) far too verbose, with a massive volume…