Please confirm or correct my understanding of what Cognito Identity Pool Federation does.
- Cognito Identity Pool does mappings between an Identity Provider Temporary Token and an IAM Role of an AWS Account. By which an Identity Provider account (e.g. Google account, Facebook account, etc) can use the AWS resources in the AWS account using a Temporary AWS STS Token.
- Identity Providers provide Users and Authentication of the users. They are Google, Facebook, etc and Cognito Userpool is just another Identity Provider by AWS.
- The users in the AWS Identity Provider (Userpool) has nothing to do with IAM account users nor groups.
Personally, I believe offering AWS's own Identity Provider service (Userpool) and Identity Provider Federation service (Identity Pool) under the same AWS Cognito is causing confusions.
Especially using the same terminology such as User, Group, Federation for different meanings depending on the contexts but both under "AWS Cognito".
The user and group in AWS Cognito Userpool has nothing to do with the AWS Account user and group. Federation in AWS Cognito Userpool is to pass the authentication process to the Identity Provider, whereas Federation in AWS Cognito Identity Pool is mapping Identity Provider Token (... or user) to an IAM Role.
Cognito Userpool AWS CLI is cognito-idp which can be confused with "IDentity Pool", but it is "IDentity Provider".
Cognito Identity Pool AWS CLI is cognito-identity but identity is managed by the Identity Providers, which AWS Cognito Userpool is.