Search code examples
amazon-web-servicesmulti-tenantamazon-cognito

Using multiple AWS Cognito Userpools for Tenants

When building multi-tenant applications in AWS, SaaS identity and isolation with Amazon Cognito uses an individual Cognito Userpool per tenant.

However there is a soft limit for the maximum number of Userpools available per AWS account which is 50 by default. Although it can be increased by contacting the support center, I'm unaware of the Hard Limits.

Does anyone know whether we can increase the limits for 1000s of UserPools or not?

Solution

  • I was able to validate this use-case by requesting a Cognito User Pool limit increase to 500.

    This was approved and it seems that its a possible way to go ahead having multiple Cognito Userpools for each tenant for multi-tenant applications. This improves the ability for.

    • Enforcing tenant isolation, through IAM policies and Roles
    • Preserve tenant context propagated through the request pipeline from Login to Data access.
    • Allows to have custom policies for each tenant (e.g Password length, MFA & etc.)

    Note: This can also add additional complexity for small size, multi-tenancy requirements and generally preferred for medium, large and enterprise projects with compliance and isolation requirements.