RU version is available. Content is displayed in original English for accuracy.
Advertisement
Advertisement
⚡ Community Insights
Discussion Sentiment
48% Positive
Analyzed from 3946 words in the discussion.
Trending Topics
#cognito#aws#docs#auth#something#don#need#using#ory#own
Discussion (102 Comments)Read Original on HackerNews
This is my experience with basically all of AWS documentation. It is nearly always either (1) far too high-level to be of any actual use, or (2) far too verbose, with a massive volume of superfluous information I need to parse and discard before I get to the stuff I am trying to figure out.
As just one example, I recently needed to link an AWS Partner Central account with an AWS Management account, and process and documentation was painfully complicated: https://docs.aws.amazon.com/partner-central/latest/getting-s...
I am myself in the IDP business, was trying to understand the pain points of the user. Even though I am not big fan of AWS but I find that the concerns are baked into the hope that using an IDP would some how make is very easy
> Flexibility of doing local development while on plane
Really depends what you are expecting from the IDP but personally this is one off situation and in most cases its not worth solving. We are in such a interconnected or dependent state where local development without internet is really hard.
> Configuration issue
The features of a solution are two edged sword, it provides people options to tailor it for their own use case and yet at the same time it adds to the learning curve. Good default might have been useful here, however it looks like Author only wanted email and nothing else so it was a departure from defaults
> UI customization
A lot of providers allow some flexibility with the UI but not a whole lot. And then some allow you to host on your website and call the API's for the authentication flows using SDK. Personally this one is tricky, its a UX vs security topic. As a thumb rule never trust the client. The request headers and ability to interact with browsers are what provides you with relatively better state and session control. As an IDP provider I do not want to loose that and still be on the hook for security.
I used to hate the AWS docs, now I use Azure and I hate that so much more. At least AWS had loads of (bad) docs that you could string together to figure out how to do something. With Azure, there's just no docs (except for bad videos), and they literally tell you (at the top of every page) that you can do this with AI (I know I can do it with AI, but I'd prefer if I could read your docs to make sure the machine isn't doing something dumb).
My expectation is that I'll end up on GCP in a few years, and that will be bad in hilariously different ways.
We were at war with them, so the team was capturing the documentation and timestamping it. They gaslit us to run the clock so the product would slide outside of mainstream support.
They have this AI tool on every page that links to the same content or references settings panes without linking anything.
I guess that's what they trained Opus 5 on
Fun times.
Nobody using AWS needs to be told "in order to add a hoozit, press the add hoozit button, fill out field A then fill out field B then fill out field C and then press next"
Now there's an interesting idea, have an LLM crawl their entire docs and cull everything obvious or content free and compile what's left
How many paid auth providers let you export user password hashes so that you can seamlessly migrate to another vendor, if you want to?
The whole problem with auth is that both (a) login screens are shown to unauthenticated users, which is a superset that includes attackers, who will do everything from DDoS to crafted malicious input to try to grab user secrets, so you really want to pick something that is already running at large production scale and with all the production battle-scars, and (b) that need to go with a managed vendor is very much in tension against local development, vendor independence, data portability, and other Good Engineering Practices (TM).
Sure, AWS Cognito sucks. In many ways, the product feels stuck. Making compromises to get stuff shipped, working, and stable sucks. But honestly, unless you're going to prefer (b) over (a) (and there are times to do so, in particular with intranet applications behind a firewall that aren't really susceptble to those kinds of attacks) and pick something like Keycloak, you could do a lot worse than Cognito (shudder, Okta, shudder).
I think Cognito is actually one of the few with absolutely no path to achieving this.
I think they allow export because they drew some interesting lines around their own mutability concerns.
I also would never use cognito again.
https://docs.aws.amazon.com/cognito/latest/developerguide/co...
Disclosure: working for Ory.
Don't like that email addresses are case sensitive, and now you want to change that? Sorry, you gotta create a new user pool from scratch--no way to migrate.
Also, want to migrate to a different provider? Sorry. You can’t get the hashed passwords out. So if you do a migration it will be painful to users since they’ll have to do a password reset.
Yes it’s cheap. But you get what you pay for.
I really don't see any reason to be using Cognito in $currentyear.
Disclosure: working for Ory.
Given all the pain I've suffered working with both cognito and auth0, I can't imagine a reason for using either in $currentyear.
Two benefits to Cognito are (1) it allows you to log into a service without having any credentials locally, and (2) that Cognito identity allows you to provide access to AWS resources. You can probably do that now, but plenty of solutions still require an on-device key...which is an obvious security issue.
Also, using your own backend for authentication made it easier to manage things because your auth wasn't trapped inside Cognito.
If you've ever tried to implement, say, a working SAML integration through Cognito, you'll know how obscure the flow is. I've had to work with the Cognito team to get real showstopping bugs fixed.
Definitely not AWS's most polished service, but workable if you know the ins and outs.
if you want hosted setups - FusionAuth, Stytch etc.
if you work in a mainstream language/framework - some excellent libraries eg in ruby authentication-zero, in js - BetterAuth, Django-all-auth.
for AWS as well - use their solutions where you don't need to read a lot of docs.
Cognito is a pain, but it mostly works once you get through their horrible docs.
Auth0 is a vendor locked PoS with a very aggressive sales team.
One big pro about cognito.. can't beat the price.
Then they figured out that their cost projection was actually off by an order of magnitude. And also kept getting bitten by peripheral systems newly getting out of sync.
And so then, they embarked upon the journey to roll it all back...
If I were starting my startup again I would, in almost every instance, trade problems if we have some success for reduced decision fatigue at the start.
On another project people didn't get this advice and we spent a two weeks working around the limitations to scrap it eventually.
We mainly choose it because AWS was used anyway and the security aspect seemed to be solved entierly with this coice (if aws get's hacked ... ).
We regretted it out of similar reasons.
Once you add in product decision making, like how to make the dev experience good on something with alot of user flows (like cognito), the products are shit.
Nowadays I can't imagine using a 3rd-party for something like auth (or many other things) due to lock-in and also just always needing to conform to their way of doing things.
Apologies for the non-sequitur but 2 days ago I saw FreshDesk had deleted my account (free plan) that I had been using (sparingly, <50 tickets total if I had to guess) for 3+ years. No email, no notice, just deleted my account and broke the sites that I had integrated their feedback widget into. I reached out to see what was going on and they pretty much told me I had to upgrade if I wanted my account back.
Now 1-2 years ago I would have considered paying. In fact I would have considered paying IF they had contacted me to say "pay up or we will delete" but the fact they deleted it without any contact meant FreshDesk was dead to me. I started, for all of 1 minute, to consider the alternatives before I fired up Claude and in <2hrs I had a full replacement for all the parts of FreshDesk I was using (basic ticketing, emails, statuses, file upload).
The build-vs-buy decision has completely flipped for me. I have a hard time thinking of paying for something my platform depends on, especially auth, when it's so easy to build it now.
Side Note: that "all-in" AWS project? Yeah, with Claude's help I'm off 90% of the AWS's services and while it's still hosted there I can move to any VPS if I want now that I've removed my dependencies on AWS-specific concepts. It's been glorious and it has the side effect of meaning my local dev more-closely matches the deployed code since there isn't AWS-magic I have to fake anymore.
Hacker News is ready for something besides "flag," because it's very frustrating to have so much LLM-generated noise clogging up /classic.
Yes, Cognito is a mess. But why can't you write about it in your own voice? Hope the clicks and SEO juice was worth insulting your readers' limited time, Josh Karamuth.
8/10 times, you don't need these 3rd party providers. Yes, someone is going to tell me all about the SSOs, SCIMs, Audit Logs etc etc but the point is that 8/10 applications are simple enough to build their own Auth. The rest, go for these services. I never understood the appeal of these 3rd party providers who can hold you hostage just for your users to login ? In 2026 ? I don't get it. May be I am dumb.
Linux/BSD as the identity/runtime layer, SSH is the protocol boundary, and your web backend is the command gateway.
It's super powerful and can do whatever you want it to do (at least if you are comfortable writing Java SPI). But there's a lot of knowledge of how to set things up that takes time and is not readily acquired.
For the record we looked at Ory early on, but it was not mature enough and didn't offer a full IdP stack at the time. We've since looked again and found there to be some conventions around how it works that made it hard for us to consider migrating from Keycloak.
Personally I choose Keycloak, but Ory is not a bad choice at all if you are willing to do more upfront work.
In a lot of ways, I really love AWS, but most of the high-value services are increasingly flaky and questionably supported, and nearly all of them have (often not very obvious) lock-in barbs.
For a while, cloud native development actually made sense. But as Cloud services have converged to become just big Kubernetes providers with API sprinkles (whose syntax is often more vinegary than sugary), there is less and less value there.
Add to that that almost no companies really need a huge cloud-based system to run their businesses, and that $500-2500 computers literally outstrip the performance of supercomputers from around the turn of the century in every respect, and there is less and less real need for cloud services...
This may now mean something along the lines of "struggling to grind through..." but is based on the original meaning of having sex without a condom, typically with misogynist overtones. You might want to avoid it for this style of writing and audience.
After working through a few transitions to/from Auth0 that is something I never ever want to do again at scale.
There’s the basic infrastructure we know and love like S3, EC2, etc.
There’s the higher level but still basic stuff that just makes a lot of sense. I like ECS + Fargate, Lambda, DynamoDB, SQS.
And then there are the tarpits. CloudFormation. Cognito. Step Functions. API Gateway. They do something useful (otherwise why would they exist?) but the main point of their existence seems to be to trap you in AWS, and the fact that they solve a problem seems secondary. Some of them are cheap (CloudFormation is free!) but in general they seem like expensive alternatives to simpler, cheaper solutions.
The really nightmarish ones are the likes of CodeStar, AppRunner, Directory Service, CodeCatalyst, and 90% of anything under the Systems Manager heading. Things that tend to be glued together from multiple lower-level services with a sprinkling of vendor lock-in on top.
And yet, I often think this about things which still suck even though AI is good at them. Like why is Siri so bad still. Why do so many basic things in windows 11 not work, like folder search? Why does Altium or anything by Xilinx always have outdated docs that refer to menus that dont exist anymore?
You'd think making AI do the annoying integration work would mean less complaints about terrible docs and API.
Like how scammers put in typos
Why use AWS for any size company?
There are lots of good options out there that enterprisey abominations.
I know because this is what my brain dead principal engineer did and I’ve spent the last 3 years chasing RFCs and am now going to spend the next year migrating to Keycloak because I’ve finally convinced my boss that we’re not an auth company.
The number of compromises something like Cognito requires are just not worth the perceived gains.