Amazon Cognito is AWS's managed customer identity service, with user pools priced per monthly active user. Pages here cover moving to self-hosted Keycloak, ZITADEL or Ory.
Moving a Cognito user pool to Keycloak realms: exporting profiles with ListUsers, choosing between forced password resets and a sign-in-time migration because Cognito exports no hashes, mapping groups, app clients and Lambda triggers, and preserving the sub claim apps depend on.
Moving Cognito customer identity to self-hosted ZITADEL: exporting users and attributes, bulk import versus migrating users as they sign in, mapping app clients to ZITADEL projects and applications, and rebuilding Lambda trigger logic as ZITADEL Actions.
Comparing Cognito user pools with self-hosted Keycloak: protocols and federation, customization of login pages, extension points (Lambda triggers versus SPIs), settings that are fixed at pool creation, cost by MAU versus infrastructure, and who operates and patches each.
Comparing Cognito with ZITADEL for application login: multi-tenant organizations, passkeys, SAML and OIDC support, the AGPL license on ZITADEL's core, self-hosting on PostgreSQL versus a managed AWS service, and when ZITADEL Cloud is the middle option.
For teams that want API-first identity rather than a hosted login page: Cognito against self-hosted Ory Kratos and Hydra, building your own UI, what Ory keeps for its enterprise license such as SAML and SCIM, and the operating work each choice brings.
Cost of ownership by component: Cognito Lite, Essentials and Plus MAU prices, free tiers, and the separate price for SAML and OIDC federated users, against Keycloak on your own infrastructure with database, high availability, support, migration and operations.
What you can get out of a Cognito user pool: ListUsers paging at 60 users per request, attributes, status and MFA options, what the export cannot include such as password hashes, and how that drives the choice between password resets and sign-in-time migration.
For products that must run on-premises, in a customer's datacenter or on another cloud, where a Cognito user pool tied to one AWS Region does not fit: self-hosted Keycloak, ZITADEL or Ory, packaging identity with the product, and keeping one login across deployments.
Some Cognito settings are fixed at creation: required attributes, username versus alias sign-in, custom attributes that can never be changed or removed, and usernames that cannot change. This page shows when those limits force a new pool anyway and when moving to a self-hosted IdP is the better rebuild.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.