Instructor: So, a common question will be,
what is the difference between a Cognito user pool
and an identity pool?
And I think they're very different,
but let me emphasize this.
So, with Cognito user pools, we have a database of users
for our web and mobile applications
and we can federate the logins
through public social liberal providers, OIDC and SAML.
We can customize the UI used for authentication,
including the logo.
And, it has triggers
with the Lambda during the authentication flow.
If we don't want to integrate, for example,
with a custom analytics solution.
Cognito identity pools allow us
to obtain AWS credentials for our users
and the users can login again
through public social or OIDC, SAML,
and also the Cognito user pools.
The users can also be guest users,
so unauthenticated users,
and they will be mapped to IAM roles and policies,
in which we can leverage policy variables
to make them tailored for our users.
So in summary,
if you use Cognito user pools and Cognito identity pools,
the first one is to manage the user and password
and the second one is to give access to AWS services.
So, this is what we were represented
in the graph in the first place.
So, our web mobile applications
wants to access our S3 bucket and our DynamoDB table.
They will login and get the token
from Cognito user pools,
which can be having its own database of users
and be integrated with logins for social providers,
SAML and OpenID connect.
Then we will exchange the tokens
for AWS credentials and Cognito identity pools,
which will validate the login,
then tucked your STS to get these credentials
and pass them back to our web and mobile applications
and then finally,
now that we have these roles and these tokens,
we can directly access AWS resources.
So, hopefully that's very clear
and I will see you in the next lecture.