Amazon Cognito pricing changed shape on November 22, 2024. A user pool is now billed on one of three feature plans, Lite, Essentials or Plus, and the rate for a monthly active user runs from $0.0025 at Lite's largest volumes to a flat $0.020 on Plus. A new pool created without choosing a plan is not on the cheapest one, because new pools default to Essentials, and Plus gives direct and social sign-in users no free tier at all. The other surprise is what makes a user active, because a read-only admin lookup counts.
Is Amazon Cognito free, and does the Cognito free tier expire?
Partly, and no, it does not expire. The Amazon Cognito pricing page says "The free tier does not automatically expire at the end of your 12-month AWS Free Tier term, and it is available to both existing and new AWS customers indefinitely." What that free tier covers depends on the plan and on how users sign in:
| Usage | Free each month |
|---|---|
| Direct and social sign-in, Lite or Essentials plan | 10,000 MAUs |
| Direct and social sign-in, Plus plan | None |
| SAML 2.0 or OIDC federated users, any plan | 50 MAUs |
| Machine-to-machine token requests | None |
| Identity pools | No charge |
The allowance is not per pool. AWS describes it as a "free tier of 10,000 monthly active user (MAU) per month per account or per AWS organization", so every pool in the account draws on the same 10,000. Plus is explicit: "There is no free tier for the Plus tier." For client credentials: "There is no free tier for token requests when Cognito is used for the machine-to-machine use case." Identity pools are the one genuinely free part: "Use of Amazon Cognito identity pools for authenticating users and generating unique identifiers is provided at no charge."
That makes Plus the plan with a cliff. A pool with 10,000 active users costs $0 a month on Essentials and $200 on Plus.
How much do the Cognito Lite, Essentials and Plus plans cost per MAU?
AWS prices the same 950,000-MAU pool in each plan on its pricing page, which is the cleanest way to compare them:
| Plan | Rate per MAU | Free MAUs | AWS example, 950,000 MAUs |
|---|---|---|---|
| Lite | $0.0055 for the first 90,000 billed, then $0.0046, falling to $0.0025 | 10,000 | $4,405 a month |
| Essentials | $0.015 | 10,000 | $14,100 a month |
| Plus | $0.020 | 0 | $19,000 a month |
Essentials costs 3.2 times Lite on that example, and Plus adds another $4,900. The feature plans page lists what the difference buys. Lite keeps password, SRP, refresh-token and custom authentication, social, SAML and OIDC sign-in, SMS and authenticator-app MFA, Lambda triggers, and machine-to-machine client credentials. Essentials adds managed login with a visual editor, email MFA, passwordless one-time codes, passkeys and access token customization. Plus adds threat protection and user activity log export.
The plan is chosen per pool, and the rate applies to every user in it. The Cognito cost management guide says the plan's "billing rate applies to all MAUs in the user pool", and gives the fix directly: "If you have users that don't need features that come with a higher-level feature plan, separate them into another user pool." A pool that needs passkeys for administrators does not need to charge Essentials rates for every customer.
What changed in the November 2024 Amazon Cognito pricing change?
Three things, and one of them has quietly lapsed. First, the default moved. The feature plans page states "The default plan selection for new user pools is Essentials." A pool created from a template that never mentions a plan is billed at $0.015 per MAU, not at the Lite rate that older tutorials assume.
Second, old pools kept a larger free tier. On the Lite plan, "Customers with existing user pools created on or before 10:00am Pacific Time, November 22, 2024 will continue having a free tier of first 50,000 MAUs." That is worth knowing before you move such a pool. At 50,000 MAUs it costs $0 on Lite, and $600 a month on Essentials, which only ever gets the 10,000.
Third, existing accounts were offered Essentials at the old price, with an end date. Eligible customers could move to Essentials "and pay the same price as Cognito user pools until November 30, 2025." That date passed more than nine months ago and the pricing page still carries the note, without saying what those pools are billed now. If you took that offer, check your Cognito line in the bill rather than assuming the promotional rate continued.
What counts as a monthly active user in Amazon Cognito?
Any identity operation on the user in a calendar month, not only a sign-in. The pricing page lists them: "like administrative creation or update, sign-up, sign-in, sign-out, token refresh, password change, a user account attribute update, or an attribute query on a user (AdminGetUser API)". So yes, a token refresh counts, which means a user who stays signed in on a long-lived refresh token is an MAU every month the app refreshes it.
The one to design around is the last item. The cost guide is blunt: AdminGetUser "marks a user as active for the month and contributes to the monthly active users (MAUs) that are used to calculate your bill for user pools." ListUsers does not. The monthly active users definition warns that "A detailed user-by-user query in a large user pool can have a significant impact on your AWS bill." A nightly job that calls AdminGetUser on every user makes the whole directory active. On Plus, every 10,000 users woken that way add $200 a month.
The same list decides how to write batch jobs against a user pool, because several operations that look equivalent are billed differently. The quotas page draws the lines. For migrations, "User CSV import doesn't contribute to your MAU count", while creating the same users one by one with an admin call does. For password hygiene, "Resetting user passwords as an administrator (AdminResetUserPassword) doesn't contribute to your MAU count", while setting a password as an administrator does. For reporting and syncs, read attributes with ListUsers or keep a copy outside Cognito, as the page suggests, rather than looping AdminGetUser. And the cost guide adds one for test suites: "Don't perform high-volume administrative testing of user pool operations with inactive users."
Switching plans mid-month does not split the difference in your favour. Each user is billed once, with "each distinct MAU being attributed to the highest-priced tier that was enabled during the user's activity." Trial Plus for a week and everyone who signed in that week is a Plus MAU for the month.
Is Cognito Plus really up to 60% cheaper than advanced security features?
Only in small pools. Before the change, threat protection was a separate add-on called advanced security features (ASF), priced per MAU on top of the base rate. AWS says pools with ASF "will continue paying based on the existing Cognito ASF price" and advertises the Plus plan as "up to 60% savings compared to using ASF". Running AWS's own figures through both models:
| MAUs | Lite plus ASF | Plus | Saving |
|---|---|---|---|
| 100,000 (AWS's ASF example) | $4,745 | $2,000 | 57.9% |
| 950,000 (AWS's Lite example) | $25,655 | $19,000 | 25.9% |
The saving shrinks as the pool grows because both old meters are tiered while Plus is a flat $0.020 with no free tier for direct and social sign-in. The AWS Price List offer file for Cognito continues the ASF bands past AWS's examples, to $0.015 per MAU from 1 million and $0.010 above 10 million, and Lite falls to $0.00325 and then $0.0025. Priced on those bands, Lite plus ASF is $45,135 against $40,000 for Plus at 2 million MAUs, so Plus saves only 11.4%, and the two meet at about 4.94 million. From there on, the old add-on is the cheaper way to buy threat protection: $191,135 against $200,000 at 10 million MAUs.
Before paying Plus rates, read the limits on the threat protection page. "You can't use threat protection with federated sign-in." Social sign-in is federation in Cognito's own terms, per the third-party sign-in guide, yet social users are billed as ordinary Plus MAUs at $0.020. A pool that signs most people in with Google pays Plus rates on users the feature cannot inspect. Threat protection also does not rate-limit: "To implement defenses against volumetric attacks in your user pools, add AWS WAF web ACLs." That is a second bill, covered in what AWS WAF actually costs.
How are SAML and OIDC federated users priced in Amazon Cognito?
At $0.015 per MAU above a 50-MAU free tier, on every plan. The pricing page repeats it under each: "For users who sign in through SAML or OIDC federation, the price for MAUs above the 50 MAU free tier is $0.015." AWS's example with 5,000 SAML users bills 4,950 of them for $74.25.
The cost guide claims federated users cost more than local users. That holds on Lite ($0.015 against $0.0055) and on the free tier (50 against 10,000). It does not hold on Plus, where a local user is $0.020 and a SAML user is $0.015.
The bigger problem is that two AWS pages disagree about linked users. The cost guide recommends linking federated users to local profiles and says "Users from SAML or OIDC IdPs who, in the course of a month, only sign in with a linked local account are billed as local users." The quotas page says a linked local user counts as an enterprise directory MAU "regardless of whether the user signs in directly or via federation." Those cannot both be true. Test it on a small group and read the bill before you relink a whole directory to save money.
How is Cognito machine-to-machine authorization priced?
Per token, not per user. The pricing page: "Amazon Cognito charges you monthly per successful token response. There is no additional charge for the number of app clients you have registered in your account." Its example prices a token request at $0.00225 in US East (N. Virginia), so 5,000 requests cost $11.25. That is the first band only. The Price List offer file tiers the meter: $0.00225 for the first 250,000 token requests a month, $0.0015 up to 5 million, and $0.001125 above that. Replicating those clients to a second Region raises the example rate to $0.002925, 30% more.
The developer guide's resource servers page describes it differently, saying "M2M billing reflects active M2M app clients" as well as token volume. The pricing page is the billing authority, but the wording is worth knowing if an app client count ever appears on your bill.
The meter scales with how often a service asks for a token, not how often it calls your API. A service that requests a fresh token on every call and makes a million requests a month pays $1,687.50: 250,000 at $0.00225 and 750,000 at $0.0015. The cost guide's advice is to cache: "Don't request a new token until previous tokens are about to expire." AWS's worked approach puts the cache in API Gateway, whose own caching charge is covered in API Gateway REST vs HTTP API pricing.
Which Amazon Cognito charges sit outside the base MAU rate?
Four. Two are billed by other services, and two are Cognito add-ons on top of the plan rate:
- SMS, billed by SNS. "Amazon Cognito uses Amazon Simple Notification Service (SNS) to send SMS messages", for MFA, sign-up, password recovery and phone verification, billed at SNS rates.
- Email, billed by SES. Verification and recovery messages go through Amazon SES and are billed there, per the same pricing page.
- Multi-Region replication, a Cognito add-on. "Amazon Cognito charges you an additional fee per monthly active user (MAU)", $0.0045 on Essentials in AWS's example, 30% on top of the base rate. It also brings a charge from another service, because "Multi-Region replication requires your user pool to use a multi-Region customer managed key (CMK) from AWS Key Management Service (AWS KMS)". That key bills under KMS: see what AWS KMS charges for.
- Higher API quotas, a Cognito add-on. Bought per requests-per-second per month, $20 per RPS-month in AWS's ongoing example and $45 for a partial month, and "Minimum duration for higher quotas is 1 day."
Because MAU billing reacts to code, not traffic, a Cognito line that jumps in a quiet month usually traces to a new admin job or a plan switch. That is the pattern a spend monitor exists to catch, compared in AWS Budgets vs Cost Anomaly Detection. For the rest of an application's security bill, the per-secret and per-call charges are in Secrets Manager vs Parameter Store, and the Cognito pricing page holds the current rate tables for every Region.
The free tier this page relies on is the older one. What a new AWS account actually receives today, and which always-free allowances survived the 2025 change, are set out in the AWS free tier changes.