Project
Amazon Cognito is an AWS managed service for user authentication and identity management, issuing OAuth 2.0/OIDC tokens via user pools.
JFrog has documented an on-behalf-of exchange so agent calls reach Artifactory as the signed-in user. The price is the Gateway's cached tool search, which per-user discovery gives up.
Reality
A dev.to walkthrough gives a Nova Sonic voice agent and an Amplify AI Kit chat agent one long-term memory in Amazon Bedrock AgentCore Memory, where every record is filed under an actorId and a sessionId. Both channels already had short-term context.
Reality
A dev.to writeup makes the case for trying Bedrock Agents or AgentCore Runtime before containers, and for putting real limits on the gateway, because a looping agent spends money without ever raising an error.
Reality
One developer took Nx Plugin for AWS 1.0, the AWS Blocks preview and Amplify Gen 2 to the same file-portal scope, deployed all three against one FSx for ONTAP access point, then deleted everything to see what stayed behind.
Reality
AWS's multi-Region replication copies a Cognito pool's configuration, hashed credentials and IdP settings into one other Region with eventual consistency. Only the primary accepts writes, so failover planning becomes a per-path decision.
Reality
Cognito validates the redirect target by matching it against the app client's allowed callback list, so a development entry nobody removed is a valid destination for an authorization code, or for the tokens themselves where implicit grant is still on.
Reality
A pool created with the defaults treats a password as the whole authentication factor and scores no risk on the sign-in. In the HackerOne chain a dev.to writeup walks through, either setting turned on would have stopped the takeover.
Reality
A survey found roughly 660 user-facing text nodes across 53 files and no i18n at all. What decides whether thirteen unreviewed locales survive is a plural-rules polyfill and the choice to store locale per user.
Reality
Agentic retrieval turns one question into an unknown number of lookups, and each is a place isolation can fail, which is why the interesting line in AWS's design is the one still leaving per-user isolation with your application.
Reality
AWS patched seven SDKs and called it a defense-in-depth enhancement. Pi says all seven third-party deployments it tested handed over live credentials, which puts the region field on your audit list.
Reality
Amazon says you should be able to name every AI agent touching customer data in under a minute. Its own worked example explains why most teams cannot: the record is a file on a laptop.
Reality
A dev.to writeup documents Amazon Cognito killing a spec-compliant MCP connector at the first redirect, and the only fix on offer is a proxy that strips one parameter and nothing else.
Reality
A new Bedrock AgentCore pattern from AWS treats the agent as an orchestrator with no say over access, pushing per-user enforcement down to DynamoDB, Knowledge Bases and Salesforce.
Reality
AWS published the build pattern most agent demos skip: isolation and cost attribution scoped per customer, not per application. Axonius chose silo and kept its existing tenant plumbing.
Reality