Amazon Cognito user pools charge per monthly active user (MAU), and the price depends on the feature tier you choose. As of November 5, 2026, Essentials costs $0.015 per MAU after 10,000 free MAUs, Plus costs $0.02 per MAU with no free tier, and Lite costs $0.0055 per MAU after 10,000 free MAUs, falling with volume. Users who sign in through SAML or OIDC federation cost $0.015 per MAU after 50 free. Identity pools are free, and SMS, email, machine-to-machine (M2M) tokens and some other features are billed separately.
Prices below are from the Amazon Cognito pricing page for US East (N. Virginia), checked on November 5, 2026. AWS changes prices and regions differ, so confirm with the AWS Pricing Calculator before you budget.
Amazon Cognito pricing at a glance
| What you pay for | Price (US East, N. Virginia) | Free amount |
|---|---|---|
| Lite tier, direct and social sign-in | $0.0055 per MAU up to 100,000 MAUs, then $0.0046 to 1M, $0.00325 to 10M, $0.0025 above 10M | 10,000 MAUs a month (50,000 for some older accounts and pools) |
| Essentials tier, direct and social sign-in | $0.015 per MAU | 10,000 MAUs a month |
| Plus tier, direct and social sign-in | $0.02 per MAU | None |
| SAML or OIDC federated users (any tier) | $0.015 per MAU | 50 MAUs a month |
| Machine-to-machine (M2M) token requests | $0.00225 per request for the first 250,000, $0.0015 to 5M, $0.001125 above 5M | None |
| Multi-Region replication (Essentials) | $0.0045 per MAU | None |
| Higher API request-rate (RPS) quotas | $20 per RPS per month, or $45 per RPS-month for part of a month | Default quotas are free |
| Identity pools | Free | |
| SMS and email messages | Billed by Amazon SNS and Amazon SES |
The free tiers apply per AWS account or AWS organization and don't expire after the usual 12-month AWS Free Tier period. They aren't available in AWS GovCloud (US) Regions.
Cognito feature tiers: Lite, Essentials and Plus
Since November 22, 2024, each Cognito user pool runs on one of three feature tiers. You can switch a pool between tiers at any time.
| Feature | Lite | Essentials | Plus |
|---|---|---|---|
| Username and password, social, SAML and OIDC sign-in | Yes | Yes | Yes |
| MFA with authenticator apps and SMS codes | Yes | Yes | Yes |
| Lambda triggers and CSS-styled managed login | Yes | Yes | Yes |
| Managed login visual editor | Yes | Yes | |
| Passwordless sign-in with one-time codes, and passkeys | Yes | Yes | |
| Email MFA, password reuse prevention | Yes | Yes | |
| Access token customization at runtime, refresh token rotation | Yes | Yes | |
| Threat protection, risk-based adaptive authentication, compromised credentials detection | Yes | ||
| Export threat and user activity logs | Yes | ||
| Multi-Region replication | Add-on | Add-on | |
| M2M authorization and higher RPS quotas | Add-on | Add-on | Add-on |
Essentials is the default for new user pools. If you need passkeys or passwordless sign-in, Lite isn't enough. If you need risk-based authentication or compromised-credential checks, you need Plus, which has no free tier.
The Cognito free tier
- Essentials and Lite: 10,000 MAUs a month per account or AWS organization, for users who sign in directly or through social providers.
- Plus: no free tier.
- Federated users: 50 MAUs a month free on any tier.
- Older accounts and pools: user pools created on or before November 22, 2024 keep a 50,000 MAU free tier. Accounts that had at least one MAU in the 12 months before that date can also create new Lite pools that use the 50,000 MAU free tier.
- M2M token requests have no free tier.
A user counts as one MAU in a month if they sign in, refresh a token, change a password, or have their account created or updated in that month. Users who do nothing that month aren't billed.
SAML and OIDC users: why B2B apps pay more
Users who sign in through their company's identity provider over SAML or OIDC are billed separately from direct sign-ins, at $0.015 per MAU after 50 free. That's the same rate as Essentials, and nearly three times the Lite rate.
For a B2B SaaS product, this matters: as you sign larger customers that require enterprise SSO, more of your users move into the federated price, regardless of the tier you picked.
Add-ons and other charges
- Machine-to-machine (M2M) authorization. Cognito issues access tokens to services through the OAuth client credentials flow. You pay per successful token request: $0.00225 each for the first 250,000 a month, $0.0015 up to 5 million, and $0.001125 beyond that. App clients themselves are free.
- Multi-Region replication. Available on Essentials and Plus. On Essentials it costs $0.0045 per MAU, counted once across your primary and secondary Regions.
- Higher API quotas. You can buy extra requests per second for API categories such as user authentication or user creation: $20 per RPS for a full month, or $45 per RPS-month for part of a month, with AWS approval.
- Advanced security features (ASF). Pools that still use the older ASF add-on pay $0.05 per MAU for the first 50,000, falling to $0.01 above 10 million. AWS says Plus can cost up to 60% less than ASF.
- SMS and email. Text messages for MFA, sign-up and recovery are billed through Amazon SNS, and email through Amazon SES, at their own rates.
Cognito pricing examples
These use the US East (N. Virginia) prices above and a new account with no legacy free tier.
| Scenario | Lite | Essentials | Plus |
|---|---|---|---|
| 25,000 MAUs, all direct sign-in | 15,000 × $0.0055 = $82.50 | 15,000 × $0.015 = $225 | 25,000 × $0.02 = $500 |
| 100,000 MAUs, all direct sign-in | 90,000 × $0.0055 = $495 | 90,000 × $0.015 = $1,350 | 100,000 × $0.02 = $2,000 |
| Add 2,000 SSO users (SAML/OIDC) | + 1,950 × $0.015 = $29.25 | + $29.25 | + $29.25 |
SMS, email, M2M tokens and any add-ons come on top. AWS's own example: a pool with 950,000 MAUs on Essentials costs $14,100 a month, and $4,405 on Lite.
What Cognito pricing doesn't include
Cognito is a building block, so some costs sit outside the bill:
- Multi-tenancy. User pools don't have a built-in concept of customer organizations. AWS documents several patterns for multi-tenant apps (a pool per tenant, an app client per tenant, or tenant groups, attributes or scopes), and each needs your own code for tenant isolation and administration.
- Customer self-service. There's no ready-made admin portal for your customers' admins to manage their users, roles or SSO connections.
- Messaging and operations. SMS through SNS can become a significant line item, and request-rate quotas may need paid increases at scale.
Frontegg: CIAM for B2B SaaS
If you're comparing Cognito for a B2B product, Frontegg includes the multi-tenant pieces Cognito leaves to you: organizations, per-customer SSO and SCIM, roles and permissions, and an admin portal for your customers' admins. Frontegg is free up to 7,500 monthly active users, including 5 SSO/SCIM connections. See Frontegg pricing and our Cognito alternatives guide.
FAQ
Is Amazon Cognito free?
Partly. Lite and Essentials include 10,000 MAUs a month for direct and social sign-in, and 50 federated (SAML/OIDC) MAUs a month on any tier. Plus has no free tier. Identity pools are free.
How much does Cognito cost for 100,000 users?
For 100,000 monthly active users signing in directly, about $495 a month on Lite, $1,350 on Essentials and $2,000 on Plus, before SMS, email and add-ons (US East, November 2026).
Does SSO cost extra in Cognito?
Users who sign in through SAML or OIDC are billed at $0.015 per MAU after the first 50 each month, on every tier.
Do Cognito identity pools cost anything?
No. Using identity pools to authenticate users and generate unique identifiers is free. You pay for the AWS services those credentials access.
Put this into practice with Frontegg
Frontegg is customer identity and access management (CIAM) for B2B SaaS. It's free up to 7,500 monthly active users, including 5 SSO/SCIM connections.
Start for free
