AWS Cognito pricing 2026
Cognito now runs three tiers: Lite, Essentials (the default for new user pools), and Plus. Essentials at $0.015/MAU above a 10,000 MAU free tier is the mainstream rate; Lite is cheaper still ($0.0055/MAU) but strips advanced security. Even Essentials is among the cheapest per-MAU in the cohort (vs Stytch B2C $0.10), but the developer experience is widely regarded as the weakest here. Best suited to AWS-native shops with engineering capacity to wrap rough edges.
- How much does AWS Cognito cost per user?
- AWS Cognito prices per monthly active user (MAU), not per seat, across three tiers. Essentials, the default for new user pools, is free for the first 10,000 MAU and $0.015 per MAU above that. Lite is cheaper at $0.0055 per MAU (10,001-100,000, then $0.0046) but drops advanced security. Plus is $0.020 per MAU with no free tier and adds adaptive authentication and threat detection.
- Does AWS Cognito have a free tier?
- Yes. Both the Lite and Essentials tiers include 10,000 monthly active users free each month for direct and social sign-in. The Plus tier has no free tier. Users who sign in through SAML or OIDC federation get only 50 free MAU on every tier, then $0.015 per federated MAU.
- How much does Amazon Cognito cost for SAML or OIDC SSO?
- SAML and OIDC federated users are billed separately from direct sign-in: the free allowance is only 50 MAU (not 10,000), after which every tier charges $0.015 per federated MAU.
- What is the difference between Cognito Lite, Essentials, and Plus?
- Lite ($0.0055/MAU) covers basic authentication with no advanced security. Essentials ($0.015/MAU, the default for new pools) adds passkeys and managed login. Plus ($0.020/MAU, no free tier) adds risk-based adaptive authentication, compromised-credential detection, and threat logging.
Tier breakdown
| Tier | $/user/mo | Annual min | Notes |
|---|---|---|---|
| Lite | Quote | . | 10,000 MAU free, then $0.0055/MAU (10,001-100,000) and $0.0046/MAU (100,001+). Basic auth only, no advanced security |
| Essentials | Quote | . | Default for new user pools. 10,000 MAU free, then $0.015/MAU flat. Adds passkeys and managed login |
| Plus | Quote | . | $0.020/MAU, no free tier. Adds adaptive auth, compromised-credential detection, threat logs |
Pricing model: MAU-based across three tiers (Lite, Essentials, Plus). 10,000 MAU free on Lite and Essentials; Plus has no free tier.
What it is best for
AWS-native engineering teams that want a managed user directory tightly integrated with IAM, Lambda, and API Gateway.
Hidden costs
- SAML / OIDC federated users get only 50 free MAU (vs 10,000 for direct and social sign-in), then $0.015/MAU across all tiers.
- The Plus tier (adaptive auth, threat detection) is $0.020/MAU with no free tier - light-traffic apps needing advanced security pay from the first user. The old Advanced Security Features add-on (roughly $0.05/MAU) was retired when Essentials/Plus tiering launched.
- SMS MFA delivery is billed at SNS rates, often higher than other CIAM bundled credits.
Feature support
Source
https://aws.amazon.com/cognito/pricing/Verified 2026-09-13. Status: live-verified.
Last verified September 2026.