AWS Cognito cost: priced per monthly active user

Quick answer

Cognito bills by monthly active user (MAU), with a free tier and tiered per-MAU rates above it, plus separate charges for advanced security features and some federation. Cost scales with your active user base, not with request volume, so the levers are counting MAUs accurately and enabling paid features only where needed.

Amazon Cognito provides user sign-up, sign-in, and access control. Its pricing is unusual for AWS in that it is per user rather than per request: you pay for monthly active users, so the bill tracks your user base and how it grows.

The MAU model

A monthly active user is one who performs an identity operation (sign-in, token refresh, and similar) in a month. Cognito includes a free tier of MAUs, then bills tiered per-MAU rates that decrease at higher volumes. Because it is per active user, an application with many registered but inactive users only pays for the ones who actually show up in a given month.

Advanced features cost extra

Component	Cost shape
Monthly active users	Free tier, then tiered per MAU
Advanced security	Additional per-MAU charge
SAML / OIDC federation	May carry a higher per-MAU rate

Advanced security features (compromised-credential detection, adaptive authentication) add a per-MAU charge on top of the base rate. Enable them where the security requirement justifies the cost, not by default across every user pool.

Keeping Cognito cost predictable

Because cost is per active user, forecast it from your active user growth, not from request volume. Enable advanced security selectively, consolidate user pools where it makes sense so you are not paying overhead across many small pools, and review which federation and feature tiers each pool actually needs. For a consumer app with millions of MAUs, small per-user differences add up, so the feature choices matter.

FAQ

How is AWS Cognito priced?

By monthly active users (MAU), with a free tier and tiered per-MAU rates above it that decrease at higher volumes, plus separate charges for advanced security features and some federation. Cost scales with your active user base rather than request volume.

What counts as a monthly active user in Cognito?

A user who performs an identity operation, such as sign-in or token refresh, in a given month. Registered but inactive users do not count for that month, so you pay only for users who actually authenticate.

How do I reduce Cognito cost?

Forecast from active-user growth, enable advanced security features only where the security requirement justifies the per-MAU charge, consolidate user pools to avoid overhead, and review which federation and feature tiers each pool actually needs.

Does Cognito charge per request?

No. Cognito bills per monthly active user, not per authentication request, so a user who signs in many times in a month counts once. This makes cost track your user base rather than traffic.

Does Cognito advanced security cost extra?

Yes, an additional per-MAU charge for features like compromised-credential detection and adaptive authentication. Enable them where the security benefit justifies the cost rather than across every user pool by default.

Does C3X estimate Cognito cost?

Cognito cost is driven by monthly active users, a usage input tied to your user base. C3X prices the surrounding infrastructure, and you model MAU volume and feature usage to estimate the per-user charge.

What to do next

Estimate the infrastructure around your auth before you build it. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.