How to Set Up Amazon Cognito Multi-Region Replication for High Availability

Summary

• Amazon Cognito now supports native multi-region replication, eliminating the need for custom sync solutions that previously took weeks to build and maintain
• The architecture replicates user data, credentials, and pool configuration from a primary to a read-only secondary region — users can authenticate in the secondary during a primary-region outage without password resets
• Cost: $0.0045–$0.006 per monthly active user per replica region (Essentials/Plus tiers)

Purpose

Deliver continuous authentication availability across regional outages. Use when your application requires high availability for sign-in flows, particularly for federated identity (social, SAML, OIDC), regulated industries requiring encryption control, and machine-to-machine authentication. Single-region Cognito is sufficient for non-critical applications or those that can tolerate authentication downtime.

Prerequisites

• AWS account with permissions for: Cognito, AWS KMS, Route 53 (optional), AWS WAF (optional), Lambda (if using custom auth flows)
• A multi-region customer-managed KMS key — this is required before you can enable replication; you cannot use an AWS-managed key for multi-region Cognito
• An existing Cognito User Pool in your primary region

Steps

1. Configure a multi-region customer-managed KMS key

In AWS KMS, create a multi-region primary key in your primary region, then create a replica key in your target secondary region. Both keys must exist and be active before you enable Cognito replication. Without this step, the replication configuration will fail.

2. Update your Cognito User Pool to use the customer-managed key

Associate the KMS key with your User Pool. This encrypts the user data that will be replicated. If your pool already uses an AWS-managed key, you must migrate to a CMK at this step.

3. Enable multi-region replication in the Cognito console

Navigate to your User Pool → Advanced security → Multi-region replication. Select your target region and initiate replication. Cognito will begin syncing user data, credentials, and pool configuration to the secondary region continuously.

4. Update your application’s OIDC issuer configuration

The secondary region’s Cognito endpoint has a different issuer URL than the primary. Update your application’s OIDC configuration to reference both, or use a dynamic resolver that switches based on health checks.

5. Implement failover routing with Route 53 (recommended)

Create a Route 53 health check on your primary Cognito endpoint. Configure a failover routing policy that routes authentication traffic to the secondary region when the primary fails the health check. This automates failover without application-level changes.

6. Manually configure Lambda, WAF, and logging on the secondary

Multi-region replication copies core user data and pool config — it does not replicate Lambda triggers, WAF associations, or CloudWatch logging. Re-deploy all custom authentication flows, security rules, and monitoring to the secondary region manually.

7. Activate the secondary pool and test failover

Manually activate the secondary pool (it starts in read-only mode). Test the full authentication flow from the secondary region to confirm tokens issue correctly, then test the Route 53 failover simulation.

The Trap

The most common mistake is assuming Lambda triggers and WAF associations replicate automatically. They don’t. A failover to the secondary region without the same Lambda triggers will skip any custom authentication logic (MFA prompts, pre-token enrichment, post-authentication events) — a silent failure that affects security and user experience without obvious error messages. Audit your trigger list before enabling replication.

Cited References

• AWS Blog: Improve your application resilience with Amazon Cognito multi-Region replication
• Amazon Cognito multi-region replication documentation
• AWS KMS multi-region keys

Source: AWS Blog

Content created with AI assistance and reviewed for accuracy.