AWS Cognito用户池与身份池为何均支持身份提供商联合？

Great question—this is a super common point of confusion, but it all boils down to the distinct core jobs of Cognito User Pools and Identity Pools. Let’s break it down clearly:

1. Cognito User Pools: Your App’s User Directory & Authentication Hub #

A User Pool is essentially your application’s dedicated user database—it handles sign-ups, logins, password resets, MFA, and user profile management. When you add an identity provider (like Google, Facebook, or a SAML enterprise tool) here, you’re letting users log into your User Pool using their existing third-party credentials.

Here’s the key value:

• These third-party users become full members of your user directory. You can add custom attributes, enforce your own MFA rules, and manage their access just like any native sign-up user.
• After authentication, the User Pool issues its own JWT tokens (ID token, access token) that your app can use to authorize access to your backend services.

In short, User Pool IdP integration is all about unifying user authentication under your app’s user system.

2. Cognito Identity Pools: Bridging Identities to AWS Resource Access #

An Identity Pool (aka Federated Identity Pool) has a totally different purpose: it converts external identity tokens into temporary AWS credentials (via AWS STS) so users can directly access AWS resources like S3 buckets, DynamoDB tables, or Lambda functions.

When you configure an IdP here, you’re telling the pool:

• "Accept tokens from this source—could be a Cognito User Pool, Google, Facebook, even a custom OAuth provider."
• "Map users from this IdP to specific IAM roles that define exactly what AWS resources they can access."

This matters because:

• You don’t even need a User Pool to use an Identity Pool—you can directly connect third-party IdPs to grant AWS access without managing a user directory.
• If you do use a User Pool, the Identity Pool can take the User Pool’s JWT tokens and translate them into AWS credentials, linking your authenticated users to AWS resource permissions.

In short, Identity Pool IdP integration is all about connecting external identities to AWS resource authorization.

Quick Scenario Cheat Sheet #

• Use User Pool IdPs if you need to manage user profiles, enforce authentication rules, or issue tokens for your own app’s backend.
• Use Identity Pool IdPs if you need to let users interact directly with AWS services, either with or without a User Pool in the mix.

They work together seamlessly too: a common setup is users logging into a User Pool (via a third-party IdP), then using the User Pool’s token to grab AWS credentials from an Identity Pool.

内容的提问来源于stack exchange，提问作者mon