Amazon Cognito

Cognito is on this list because it's unavoidable for teams building on AWS. If your agent infrastructure runs on Lambda, API Gateway, and Bedrock, Cognito is the path of least resistance for auth — not because it's the best option, but because it integrates directly with IAM and AWS's security model.

The developer experience is a known pain point. Configuration is complex, documentation is dense, and the mental model (User Pools vs. Identity Pools vs. Federated Identities) is confusing compared to modern alternatives. But for teams where AWS is the non-negotiable platform, the integration benefits often outweigh the DX cost.

For agentic workloads, Cognito supports M2M via the client credentials grant and token delegation through standard OAuth flows. There's no dedicated agent SDK, no FGA, and no human-in-the-loop support — but agents can authenticate using standard OIDC tokens that API Gateway and Lambda can verify natively.

Agent-specific features:

• Client credentials grant for M2M / agent-to-service auth
• JWT tokens verifiable by API Gateway and Lambda authorizers
• OAuth 2.0 token delegation via Resource Server scopes
• IAM integration for AWS resource access
• Supports Bedrock agent authentication patterns