Amazon Cognito Pricing Calculator & Complete Cost Guide
Interactive Amazon Cognito pricing calculator. Compare Lite, Essentials, and Plus tiers, understand MAU-based pricing, and optimize your authentication costs.
Pricing TLDR
- • Free tier: First 10,000 MAUs free monthly (Lite & Essentials)
- • Lite: $0.0055-$0.0025/MAU (volume discounts) • Essentials: $0.015/MAU (default)
- • Plus: $0.02/MAU (no free tier) • Enterprise SSO: +$0.015/MAU (50 free)
Amazon Cognito Pricing Calculator
Quick Examples:
Select Pricing Tier
Value-oriented, volume discounts ($0.0055-$0.0025/MAU)
Managed login & passwordless ($0.015/MAU flat rate)
Threat protection & compliance ($0.02/MAU, no free tier)
Monthly Active Users (MAU)
0
1,000,000
Enable Enterprise SSO (SAML/OIDC)
Estimated Monthly Cost
225.00
Cognito Essentials
225.00
25,000 MAU
About Amazon Cognito
What is Amazon Cognito?
Amazon Cognito is AWS's fully managed user authentication and authorization service that provides scalable user sign-up, sign-in, and access control for web and mobile applications. It supports username/password authentication, social identity providers (Google, Facebook, Amazon, Apple), enterprise federation (SAML 2.0, OIDC), and passwordless authentication options like passkeys and one-time passwords.
- User Pool Authentication: Managed user directory with sign-up, sign-in, password recovery, and profile management
- Social & Enterprise Federation: Integrate Google, Facebook, Apple, Amazon, SAML 2.0, and OIDC identity providers
- Passwordless Authentication: Support passkeys (WebAuthn), email OTP, and SMS OTP for modern authentication experiences
- Advanced Security: Threat protection, compromised credentials detection, and adaptive authentication (Plus tier)
When to Use Amazon Cognito
Amazon Cognito is ideal for applications requiring scalable user authentication with minimal backend infrastructure. Choose Cognito when you need managed authentication, social login, or enterprise federation.
Ideal for
- Web and mobile applications with user authentication
- Apps requiring social sign-in (Google, Facebook, Apple)
- Enterprise applications with SSO via SAML/OIDC
- Microservices architectures with M2M authentication
- Applications needing passwordless or MFA security
Not ideal for
- Very simple apps under 10K users (consider free tier carefully)
- High-volume microservices (M2M costs can dominate)
- Apps requiring extensive custom authentication logic
Amazon Cognito Pricing Breakdown
Pricing Tier Comparison
Amazon Cognito offers three pricing tiers with different features and cost structures (effective December 1, 2024). Note: Pricing is uniform globally across all 34 AWS regions.
Lite
10,000 MAU/month
Essentials
10,000 MAU/month
Plus
None
Lite
Volume-based (5 tiers)
Essentials
Flat rate
Plus
Flat rate
Lite
$0.0055 - $0.0025/MAU
Essentials
$0.015/MAU
Plus
$0.02/MAU
Lite
No
Essentials
Yes ✓
Plus
No
Lite
✗
Essentials
✓
Plus
✓
Lite
✗
Essentials
✓ (passkeys, OTP)
Plus
✓ (passkeys, OTP)
Lite
✗
Essentials
✗
Plus
✓
Lite
✗
Essentials
✗
Plus
✓
Lite
>100K MAU, cost-conscious
Essentials
Most applications
Plus
Compliance, high security
All tiers include social identity providers, SAML/OIDC federation, Lambda triggers, and base features. Plus tier offers 60% savings vs legacy Advanced Security Features.
Cognito Lite Volume Pricing
Volume-based pricing with discounts at higher tiers
MAU Range
0 - 10,000
Price per MAU
$0.00
Example Cost (at upper bound)
$0.00 (FREE)
MAU Range
10,001 - 100,000
Price per MAU
$0.0055
Example Cost (at upper bound)
$495.00 (100K MAU)
MAU Range
100,001 - 1,000,000
Price per MAU
$0.0046
16% discount
Example Cost (at upper bound)
$4,635.00 (1M MAU)
MAU Range
1,000,001 - 10,000,000
Price per MAU
$0.00325
29% discount
Example Cost (at upper bound)
$33,885.00 (10M MAU)
MAU Range
10,000,001+
Price per MAU
$0.0025
23% discount
Example Cost (at upper bound)
$0.0025 per additional MAU
Lite tier provides the best value for high-volume applications (>100K MAU) with automatic volume discounts.
Additional Charges
Separate costs not included in base tier pricing
Service
Enterprise SSO (SAML/OIDC)
Free Tier
50 MAU/month
Pricing
$0.015/MAU
Service
M2M App Clients
Free Tier
None
Pricing
$6-$1.50/client/month
Volume tiers
Service
M2M Token Requests
Free Tier
None
Pricing
$0.00225-$0.001125/request
Volume tiers
Service
SMS Messages (via SNS)
Free Tier
None
Pricing
$0.00645+ per SMS
Varies by country
Service
Additional RPS Quota
Free Tier
120 RPS/category
Pricing
$20-$45/RPS/month
Full/partial month
Service
Identity Pools
Free Tier
Unlimited
Pricing
FREE
Email verification via SES is included in AWS free tier (62,000 emails/month from EC2). TOTP MFA is free, SMS MFA costs extra.
Real-World Amazon Cognito Pricing Examples
Startup (5K MAU) - Lite
$0.53/month
• User Authentication (Lite): $0.00 (under 10K free tier)
• Email Verification (SES): $0.00 (under free tier)
• TOTP MFA: $0.00 (free)
• CloudWatch Logs (1GB): $0.53
• All users within 10K free tier
• No SMS costs (TOTP only)
Small SaaS application with basic authentication using Cognito Lite
SaaS App (50K MAU) - Lite
$222.65/month
• User Authentication (Lite): $220 (10K free + 40K × $0.0055)
• Email Verification (SES): $0.00 (under free tier)
• TOTP MFA: $0.00 (free)
• CloudWatch Logs (5GB): $2.65
• Lite tier 60% cheaper than Essentials ($600)
• TOTP instead of SMS saves ~$320/month
Growing B2B application using Cognito Lite for cost efficiency
E-Commerce (200K MAU) - Essentials
$2,874.40/month
• User Authentication (Essentials): $2,850 (10K free + 190K × $0.015)
• Email Verification (SES): $13.80 (200K emails)
• Passkeys (Passwordless): $0.00 (included in Essentials)
• CloudWatch Logs (20GB): $10.60
• Essentials tier for managed login & passwordless
• Passkeys improve conversion rates
Consumer-facing platform using passwordless authentication for better UX
Financial Services (1M MAU) - Plus
$20,866.05/month
• User Authentication (Plus): $20,000 (1M MAU × $0.02)
• Enterprise SSO (5,000 users): $74.25 (50 free + 4,950 × $0.015)
• Email Verification (SES): $93.80 (1M emails)
• SMS MFA (10% users, US): $645 (100K SMS × $0.00645)
• CloudWatch Logs (100GB): $53
• Plus tier required for compliance (SOC 2, HIPAA)
• 60% cheaper than legacy ASF pricing
High-security application requiring threat protection and compliance
Microservices Platform (10K MAU + M2M) - Lite
$8,040.50/month
• User Authentication (Lite): $0.00 (10K MAU free tier)
• M2M App Clients (50 services): $300 (50 × $6/client)
• M2M Token Requests (5M/month): $7,687.50
• CloudWatch Logs (100GB): $53
• M2M costs dominate (99% of total)
• Cache tokens for 1-hour expiry to reduce costs 95%
API-first architecture with heavy machine-to-machine authentication
10 Amazon Cognito Cost Optimization Tips
Choose the Right Tier for Your Volume
Use Lite tier for >100K MAU (70% cheaper than Essentials). Essentials is default but only optimal if you need managed login or passwordless. Avoid Plus unless compliance requires threat protection and log exports.
Don't Default to Essentials
New user pools default to Essentials tier. Manually switch to Lite if you don't need managed login UI or passwordless authentication. This saves 60-73% at most volume levels (e.g., $855/month at 100K MAU).
Use Passwordless or TOTP Instead of SMS MFA
SMS MFA costs $0.00645+ per message via SNS (varies by country). Use free TOTP authenticators (Google Authenticator, Authy) on Lite tier, or passkeys on Essentials/Plus. Potential savings: $64-$3,929/month depending on volume.
Cache M2M Tokens for Full 1-Hour Expiry
Without caching, microservices can generate 30M+ token requests/month. Caching tokens for their 1-hour expiry reduces requests by 95%+ (from $46,312 to $2,531/month for 100 services). Implement application-level token storage.
Stay Under Base RPS Quota (120 RPS)
Additional Request Per Second quota costs $20-$45/RPS/month. Implement exponential backoff, CloudFront caching, and batch operations during off-peak hours to stay under 120 RPS per API category.
Never Change Tiers on Legacy Pools
User pools created before November 22, 2024 have 50K free tier (5x more generous). Changing tiers drops you to 10K free tier. For a 40K MAU app, this means going from $0/month to $220/month (Lite) or $600/month (Essentials).
Use Social Sign-In to Skip Email Verification
Social identity providers (Google, Facebook, Apple) don't require email verification, saving SES costs. Also provides faster user onboarding and better conversion rates. Savings: $3.80-$43.80/month depending on volume.
Leverage Free Identity Pools for AWS Access
If you only need AWS resource access (not user authentication), use Cognito Identity Pools which are completely free. Identity Pools provide federated identities for S3, DynamoDB, etc. without user pool costs.
Optimize Email Delivery with SES from EC2
Send verification emails from EC2 instances (not Lambda) to get 62,000 free emails/month via SES. After free tier, SES costs $0.10/1,000 emails. Batch verification emails and skip for social logins.
Monitor Cognito Costs in Real-Time
Track Amazon Cognito spending across all user pools and regions with CostGoat. Get instant alerts when MAU counts spike unexpectedly, when tier selection is suboptimal, or when M2M token requests explode due to caching issues.
Monitor Your AWS Costs in Real-Time
CostGoat is a privacy-first desktop app that tracks your actual AWS spending as you use it. Get instant visibility into your usage and never get surprised by your cloud bills again. 7-day free trial, then $9/month.
Start Free Trial