Cognito User Profiles Export Reference Architecture

Many Amazon Web Services (AWS) customers use Amazon Cognito User Pools to provide a scalable and secure user directory for their applications. Amazon Cognito customers often need to export user information to facilitate more complex user queries, or to provide resiliency in case of Regional failure or accidental deletion of their users' profiles. To assist with this, AWS offers the Cognito User Profiles Export Reference Architecture solution. This solution is designed to provide a framework for exporting user profile and group information from a user pool, allowing users to focus on extending this solution’s functionality rather than managing the underlying infrastructure operation.

This solution uses an AWS Step Functions export workflow to periodically export user profiles, groups, and group membership details from a user pool to an Amazon DynamoDB global table with automatic, asynchronous replication to a backup Region for added resiliency.

This solution’s Step Functions import workflow can be used to populate a new, empty user pool with data from the global table, allowing users to easily recover user profiles, groups, and group memberships. The import workflow can be run in either the primary or backup Region.

Customers interested in using this solution should be aware that it does not export sensitive information, such as user passwords; that user pools with multi-factor authentication (MFA) enabled are not supported; and that advanced security features are not supported. For a full list of limitations, refer to the implementation guide.