Amazon Cognito Strengthens Application Resilience with Multi-Region Replication

Previously, in the event of an AWS Region outage, developers had to build their own replication solutions or manually manage data to maintain consistency in user authentication. This process led to data inconsistencies, security risks, and the inconvenience of forcing users to re-authenticate during Region failover.

Amazon Cognito's multi-Region replication automatically synchronizes user data and machine secrets to a selected secondary AWS Region. Replication proceeds in one direction, from the primary Region to the secondary Region, and includes the following items:

• User profiles and credentials
• Pool configurations
• Secrets for machine-to-machine communication

The secondary Region operates in read-only mode, and existing sessions are maintained without interruption. It also supports both social sign-in (Google, Apple, etc.) and federation via SAML and OIDC, ensuring availability for both customer-facing apps and backend services simultaneously. However, during failover, new user registration or profile updates are restricted.

For security, data can be encrypted using customer managed keys in AWS KMS. This allows for a consistent encryption strategy across multiple Regions and strengthens control over data.