Amazon Cognito Pricing Calculator & Complete Cost Guide
Interactive Amazon Cognito pricing calculator. Compare Lite, Essentials, and Plus tiers, understand MAU-based pricing, and optimize your authentication costs.
Pricing TLDR
- • Free tier: First 10,000 MAUs free monthly (Lite & Essentials)
- • Lite: $0.0055-$0.0025/MAU (volume discounts) • Essentials: $0.015/MAU (default)
- • Plus: $0.02/MAU (no free tier) • Enterprise SSO: +$0.015/MAU (50 free)
Official pricing:
AWSAmazon Cognito Pricing Calculator
Quick Examples:
Select Pricing Tier
Value-oriented, volume discounts ($0.0055-$0.0025/MAU)
Managed login & passwordless ($0.015/MAU flat rate)
Threat protection & compliance ($0.02/MAU, no free tier)
Monthly Active Users (MAU)
0
1,000,000
Enable Enterprise SSO (SAML/OIDC)
Estimated Monthly Cost
225.00
Cognito Essentials
225.00
25,000 MAU
Tired of AWS billing surprises?
Track your actual AWS spending as it happens.
Free 7-day trial. No sign-up, no credit card.
About Amazon Cognito
What is Amazon Cognito?
Amazon Cognito is AWS's fully managed user authentication and authorization service that provides scalable user sign-up, sign-in, and access control for web and mobile applications. It supports username/password authentication, social identity providers (Google, Facebook, Amazon, Apple), enterprise federation (SAML 2.0, OIDC), and passwordless authentication options like passkeys and one-time passwords.
- User Pool Authentication: Managed user directory with sign-up, sign-in, password recovery, and profile management
- Social & Enterprise Federation: Integrate Google, Facebook, Apple, Amazon, SAML 2.0, and OIDC identity providers
- Passwordless Authentication: Support passkeys (WebAuthn), email OTP, and SMS OTP for modern authentication experiences
- Advanced Security: Threat protection, compromised credentials detection, and adaptive authentication (Plus tier)
When to Use Amazon Cognito
Amazon Cognito is ideal for applications requiring scalable user authentication with minimal backend infrastructure. Choose Cognito when you need managed authentication, social login, or enterprise federation.
Ideal for
- Web and mobile applications with user authentication
- Apps requiring social sign-in (Google, Facebook, Apple)
- Enterprise applications with SSO via SAML/OIDC
- Microservices architectures with M2M authentication
- Applications needing passwordless or MFA security
Not ideal for
- Very simple apps under 10K users (consider free tier carefully)
- High-volume microservices (M2M costs can dominate)
- Apps requiring extensive custom authentication logic
Amazon Cognito Free Tier
Always free
A permanent allowance on every account type. It never expires.
10K
MAUs (social & direct sign-in)
50
MAUs (SAML / OIDC)
Monthly active users, resets each month, on the Lite or Essentials tier
New accounts · since July 2025
You get the full 10,000-MAU allowance permanently, the same as legacy accounts, plus up to $200 in credits. Note: AWS cut this from the old 50,000-MAU free tier, so older guides overstate it.
Watch out for
- The Plus tier and machine-to-machine (M2M) token requests have no free tier
- SAML and OIDC federation is capped at 50 MAUs, far below the 10K social limit
- Advanced security features bill on top of the MAU price
Full service-by-service breakdown, the July 2025 changes, and the common billing traps in the AWS Free Tier reference.
Amazon Cognito Pricing Breakdown
Pricing Tier Comparison
Amazon Cognito offers three pricing tiers with different features and cost structures (effective December 1, 2024). Note: Pricing is uniform globally across all 34 AWS regions.
Lite
10,000 MAU/month
Essentials
10,000 MAU/month
Plus
None
Lite
Volume-based (5 tiers)
Essentials
Flat rate
Plus
Flat rate
Lite
$0.0055 - $0.0025/MAU
Essentials
$0.015/MAU
Plus
$0.02/MAU
Lite
No
Essentials
Yes ✓
Plus
No
Lite
✗
Essentials
✓
Plus
✓
Lite
✗
Essentials
✓ (passkeys, OTP)
Plus
✓ (passkeys, OTP)
Lite
✗
Essentials
✗
Plus
✓
Lite
✗
Essentials
✗
Plus
✓
Lite
>100K MAU, cost-conscious
Essentials
Most applications
Plus
Compliance, high security
All tiers include social identity providers, SAML/OIDC federation, Lambda triggers, and base features. Plus tier offers 60% savings vs legacy Advanced Security Features.
Cognito Lite Volume Pricing
Volume-based pricing with discounts at higher tiers
MAU Range
0 - 10,000
Price per MAU
$0.00
Example Cost (at upper bound)
$0.00 (FREE)
MAU Range
10,001 - 100,000
Price per MAU
$0.0055
Example Cost (at upper bound)
$495.00 (100K MAU)
MAU Range
100,001 - 1,000,000
Price per MAU
$0.0046
16% discount
Example Cost (at upper bound)
$4,635.00 (1M MAU)
MAU Range
1,000,001 - 10,000,000
Price per MAU
$0.00325
29% discount
Example Cost (at upper bound)
$33,885.00 (10M MAU)
MAU Range
10,000,001+
Price per MAU
$0.0025
23% discount
Example Cost (at upper bound)
$0.0025 per additional MAU
Lite tier provides the best value for high-volume applications (>100K MAU) with automatic volume discounts.
Additional Charges
Separate costs not included in base tier pricing
Service
Enterprise SSO (SAML/OIDC)
Free Tier
50 MAU/month
Pricing
$0.015/MAU
Service
M2M App Clients
Free Tier
Unlimited
Pricing
FREE
Service
M2M Token Requests
Free Tier
None
Pricing
$0.00225-$0.001125/request
Volume tiers
Service
SMS Messages (via SNS)
Free Tier
None
Pricing
$0.00645+ per SMS
Varies by country
Service
Additional RPS Quota
Free Tier
120 RPS/category
Pricing
$20-$45/RPS/month
Full/partial month
Service
Identity Pools
Free Tier
Unlimited
Pricing
FREE
Email verification via SES is included in AWS free tier (62,000 emails/month from EC2). TOTP MFA is free, SMS MFA costs extra.
Real-World Amazon Cognito Pricing Examples
Startup (5K MAU) - Lite
$0.53/month
• Auth (Lite): $0.00
• Email (SES): $0.00
• TOTP MFA: $0.00
• Logs (1GB): $0.53
• Within 10K free tier
• No SMS, TOTP only
Small SaaS application with basic authentication using Cognito Lite
SaaS App (50K MAU) - Lite
$222.65/month
• Auth (Lite): $220
• Email (SES): $0.00
• TOTP MFA: $0.00
• Logs (5GB): $2.65
• Lite saves 63% ($380)
• TOTP saves ~$320/mo
Growing B2B application using Cognito Lite for cost efficiency
E-Commerce (200K MAU) - Essentials
$2,874.40/month
• Auth (Ess.): $2,850
• Email (SES): $13.80
• Passkeys: $0.00
• Logs (20GB): $10.60
• Managed login tier
• Better conversion
Consumer-facing platform using passwordless authentication for better UX
Financial Services (1M MAU) - Plus
$20,866.05/month
• Auth (Plus): $20,000
• SSO: $74.25
• Email (SES): $93.80
• SMS MFA: $645
• Logs (100GB): $53
• Plus for compliance
• 60% under legacy ASF
High-security application requiring threat protection and compliance
Microservices Platform (10K MAU + M2M) - Lite
$7,740.50/month
• Auth (Lite): $0.00
• M2M clients: $0.00
• M2M tokens: $7,687.50
• Logs (100GB): $53
• M2M tokens dominate
• Cache tokens, save 95%
API-first architecture with heavy machine-to-machine authentication
10 Amazon Cognito Cost Optimization Tips
Choose the Right Tier for Your Volume
Use Lite tier for >100K MAU (70% cheaper than Essentials). Essentials is default but only optimal if you need managed login or passwordless. Avoid Plus unless compliance requires threat protection and log exports.
Don't Default to Essentials
New user pools default to Essentials tier. Manually switch to Lite if you don't need managed login UI or passwordless authentication. This saves 60-73% at most volume levels (e.g., $855/month at 100K MAU).
Use Passwordless or TOTP Instead of SMS MFA
SMS MFA costs $0.00645+ per message via SNS (varies by country). Use free TOTP authenticators (Google Authenticator, Authy) on Lite tier, or passkeys on Essentials/Plus. Potential savings: $64-$3,929/month depending on volume.
Cache M2M Tokens for Full 1-Hour Expiry
Without caching, microservices can generate 30M+ token requests/month. Caching tokens for their 1-hour expiry reduces requests by 95%+ (from $46,312 to $2,531/month for 100 services). Implement application-level token storage.
Stay Under Base RPS Quota (120 RPS)
Additional Request Per Second quota costs $20-$45/RPS/month. Implement exponential backoff, CloudFront caching, and batch operations during off-peak hours to stay under 120 RPS per API category.
Never Change Tiers on Legacy Pools
User pools created before November 22, 2024 have 50K free tier (5x more generous). Changing tiers drops you to 10K free tier. For a 40K MAU app, this means going from $0/month to $165/month (Lite) or $450/month (Essentials).
Use Social Sign-In to Skip Email Verification
Social identity providers (Google, Facebook, Apple) don't require email verification, saving SES costs. Also provides faster user onboarding and better conversion rates. Savings: $3.80-$43.80/month depending on volume.
Leverage Free Identity Pools for AWS Access
If you only need AWS resource access (not user authentication), use Cognito Identity Pools which are completely free. Identity Pools provide federated identities for S3, DynamoDB, etc. without user pool costs.
Optimize Email Delivery with SES from EC2
Send verification emails from EC2 instances (not Lambda) to get 62,000 free emails/month via SES. After free tier, SES costs $0.10/1,000 emails. Batch verification emails and skip for social logins.
Monitor Cognito Costs in Real-Time
Track Amazon Cognito spending across all user pools and regions with CostGoat. Get instant alerts when MAU counts spike unexpectedly, when tier selection is suboptimal, or when M2M token requests explode due to caching issues.
Start Tracking Your AWS Spending
Monitor your AWS spending in real-time. Set custom budget alerts and get notified before costs spiral.
Free 7-day trial. No sign-up, no credit card.
