Is Amazon Cognito cost lower than running Keycloak yourself?
A team paying Cognito charges that climb with monthly active users and federated users should ask whether self-hosting ends that growth, but the answer depends on what replaces the bill. Keycloak is licensed under Apache 2.0, so it carries no license fee. The cost of running it sits in infrastructure, a supported production database, high availability, migration and day-to-day operations. Those components scale differently from Cognito's per-user pricing. Compute and database capacity grow in steps as load rises, while much of the operating effort stays roughly flat as users increase. The comparison therefore turns on volume and staffing, and a simple per-user comparison misses both. For current Cognito rates, including the price for SAML and OIDC federated users, check the AWS pricing page, because those figures change and this page does not reproduce them.
Self-hosting usually costs less at high user volume, but only when the staff time is already on hand. A production setup needs a supported database (PostgreSQL 14 to 18 is on Keycloak's list), a synchronously replicated database for the high availability designs, nodes spread across availability zones, monitoring, backups and upgrades. Keycloak's own documentation warns that realm export and import has limitations as a backup method and that all nodes must stop while it runs, so backup needs its own design. Minor releases arrive four times a year, and someone must test each one. If your estate is small and no platform team exists, the fixed cost of those tasks usually outweighs the savings, and the Cognito bill stays the cheaper option.
Before deciding, build a two-sided model using the same users, logins and environments. On the Cognito side, pull current monthly active user and federated user counts, price them on the AWS pricing page, and confirm which feature tier your user pool uses. On the Keycloak side, list each component with a named owner: compute, the database service, load balancing, backup storage, monitoring, on-call coverage and time spent on upgrades. Mark which items are one-time, such as migration and initial hardening, and which recur. When you ask a partner for a quote, request these lines broken out alongside the written scope behind them. Then test the sensitivity: if your user count doubles, which lines move and which stay flat?
Which Amazon Cognito cost components move onto your own infrastructure
This table places Amazon Cognito charges beside the components you would carry when Keycloak runs in your own infrastructure. Read each row as a question for a quote: which costs go to AWS, which go to a software subscription, and which go to your staff or a contractor. The main takeaway is that Keycloak removes the per-user software charge but moves hosting, database, availability and upgrade work onto your side.
| Cost component | Amazon Cognito | Self-hosted Keycloak | One-time or recurring |
|---|---|---|---|
| Subscription or license | Charged per monthly active user by tier (Lite, Essentials, Plus). Confirm current rates on the AWS pricing page. | Apache 2.0 license with no license fee. An optional Red Hat build of Keycloak subscription adds vendor support. | Cognito: recurring. Keycloak: none, or recurring if you subscribe to Red Hat. |
| Federated users | Separate charges for SAML and OIDC federated users, added on top of monthly active user charges. | SAML 2.0 and OIDC federation are part of the software. Cost is compute and staff time to configure identity providers. | Cognito: recurring. Keycloak: none for the features themselves. |
| Infrastructure | Managed by AWS, so there are no servers to size or patch. | Compute for Keycloak nodes sized to peak login and token volume, plus a load balancer in front. | Recurring. Main drivers are login peaks and token lifetimes. |
| Database | Included in the managed service with no separate database to run. | A supported production database such as PostgreSQL 14 to 18, with backups, storage and monitoring. | Recurring for hosting and storage, one-time for setup. |
| High availability | AWS operates availability within the Region where the user pool sits. | Several nodes across availability zones and a synchronously replicated database, with failover tested by your team. | Recurring for extra nodes, one-time for the design and failover tests. |
| Implementation and migration | Export users with ListUsers, plan password handling, and rework app clients and Lambda triggers. | Realm design, user import, client configuration, and rebuilding Lambda trigger logic as Keycloak flows or SPIs. | One-time. Scope depends on the number of apps, triggers and federated sources. |
| Support | AWS support plans are billed separately. Confirm the plan that matches your response needs. | Community support for the open-source release, or a paid Red Hat subscription or a written retainer for response commitments. | Recurring if you buy support. Optional for the software. |
| Upgrades and operations | AWS handles service patching and updates to the managed service. | Your team plans upgrades, uses manual approval for operator updates, and tests schema migrations. Keycloak plans four minor releases a year. | Recurring staff time, with one-time setup of the upgrade process. |
| Internal skills | Staff need AWS IAM, Lambda, CloudWatch and Cognito configuration knowledge. | Staff need Keycloak administration, database operations, Kubernetes or virtual machine operations and security monitoring. | Recurring staff time, or one-time training and hiring. |
What moves the Cognito versus Keycloak cost comparison most
Six variables decide whether Cognito or self-hosted Keycloak costs less over time. Most of them scale with users, federation and uptime targets, while others depend on the skills your team already has.
Monthly active users
Cognito bills by monthly active users, so the cost curve rises with every new active account. Self-hosted Keycloak costs mostly follow compute, database capacity and operations, which grow in steps rather than per login. Ask your AWS account team for the current tier boundaries and whether your MAU count includes federated sign-ins. Model growth in both directions before comparing totals.
Federated SAML and OIDC users
Cognito prices federated users separately from its native user pool, so enterprise customers who sign in through their own SAML or OIDC providers can change the bill more than expected. Keycloak has no per-federated-user meter, but you must run and patch the broker configuration. Count federated identities per customer, not only direct accounts, and confirm the current federation rates in writing.
App clients and realms or pools
Each app client, pool or realm multiplies configuration, testing and token policy work. Cognito charges are tied to pools and users, while Keycloak spreads cost across realms on shared infrastructure but adds administration effort per realm. Inventory every application and environment that needs its own client settings. Consolidating or splitting realms changes both the operating model and the migration scope.
Availability targets across zones
A Keycloak deployment that meets a multi-zone availability target needs a clustered setup and a synchronously replicated database, which means more nodes, more database capacity and more failover testing. Cognito's regional managed service removes that build work from your team. Write down the recovery and uptime commitments your business requires, then price the second zone and the standby database explicitly.
Data volume and retention
Event logs, audit records and backups grow with login volume and retention policy. In Cognito, log delivery and storage land in other AWS services and are billed separately, while in Keycloak you pay for database storage, backup copies and log pipelines you operate. Decide how long authentication events must be kept and where backups live before estimating storage. Keycloak's export and import tooling is not a complete backup method, so plan for database-level backups.
In-house Kubernetes and database skills
The labor cost of self-hosting depends on whether your platform team already runs Kubernetes, PostgreSQL and secure upgrades. Without that experience, you pay for training, external support or a retainer, and these costs recur. With it, the infrastructure line is smaller and the main expense is on-call time. Assess current staffing against the upgrade cadence and the database requirements before accepting any total cost figure.
How Cognito tier and federation charges compound over time
The core point is that a Cognito bill is a usage bill that moves with every monthly active user, while a self-hosted Keycloak bill is mostly a fixed-capacity bill that changes in steps. Cognito user pools are priced in tiers named Lite, Essentials and Plus, and users who sign in through federated SAML or OIDC identity providers are charged at a separate rate. If your workforce or partner logins arrive mainly through federation, the bill can grow faster than your user base, because each federated sign-in is priced on its own line rather than as a plain user.
Do not rely on figures from this page or from memory. Open the AWS pricing page for Cognito in your target region and record three numbers: the current rate for each tier, the free tier allowance, and the rate for federated users. Then multiply each rate by your own monthly active user forecast, split into native users and federated users, for at least the next 24 months. Ask your finance team to model a growth scenario and a flat scenario, so you can see where the curve bends. Confirm whether your region's rates differ from the published defaults before you put the numbers in a business case.
Keycloak costs behave differently. Most of the spend is the database, the nodes sized for peak sign-in load, the high availability design, and the people who operate and patch them. These costs step up when you add a node or a database tier, and they stay roughly flat between steps, so user growth does not add a line item for each login. Keep the one-time costs (design, migration and hardening) separate from the recurring ones (infrastructure, staff time, support and upgrades). Ask any implementation partner for a written quote that lists each of these components, so the comparison with the Cognito forecast is like for like.
How the Keycloak cost changes with the deployment option
A single Keycloak cluster on virtual machines or containers is the most direct model. Keycloak itself is Apache 2.0 licensed, so the recurring costs sit in the infrastructure, the database and the people who run them. You need a load balancer, at least two Keycloak nodes for availability, a supported production database and monitoring. Keycloak documents a high availability design in which a single cluster can optionally span availability zones, and both supported designs need a synchronously replicated database.
- Added components: a load balancer, two or more nodes, a supported production database such as PostgreSQL 14 to 18, and metrics collection.
- Staff skills: Linux administration, reverse proxy and TLS configuration, database operations, and enough Keycloak knowledge to run clustering and realm configuration.
- Upgrade approach: your team schedules each minor upgrade, reads the upgrading guide, and chooses between automatic schema migration at startup and manual SQL for larger deployments.
- Subscription option: none is required, so support is whatever your team or an implementation partner provides under a written scope.
- Cost drivers: node sizing, database sizing and replication, and the hours spent on patching and testing each release.
Before you rely on this model, confirm the database and high availability design with your own architects and check the current release notes for the version you plan to run.
The Keycloak Operator runs Keycloak on Kubernetes and manages it through custom resources such as Keycloak, KeycloakRealmImport, KeycloakOIDCClient and KeycloakSAMLClient. The Operator is installed through Operator Lifecycle Manager, which the Keycloak documentation recommends, although kubectl and an experimental Helm chart are also listed. The cost moves from virtual machine administration to cluster operations, which only pays off if your organization already runs Kubernetes well.
- Added components: a Kubernetes cluster, Operator Lifecycle Manager, ingress, persistent storage and the same production database used in a single cluster.
- Staff skills: Kubernetes administration, GitOps or manifest management for custom resources, and the same Keycloak and database skills as the single cluster model.
- Upgrade approach: the Operator documentation strongly recommends manual approval mode for operator updates, so upgrades happen when your team approves them rather than automatically.
- Subscription option: none is required, but the cluster platform itself may carry its own licensing or support costs depending on your distribution.
- Cost drivers: whether the cluster already exists, the size of the node pool, and how many realms and clients are managed as code.
Confirm with your platform team whether an existing cluster and Operator Lifecycle Manager are already in place, because that single fact changes this option's cost more than anything else.
The Red Hat build of Keycloak is Red Hat's supported distribution based on the open source Keycloak project, and it replaces Red Hat Single Sign-On. It is the option when your organization wants a vendor-backed support path for the same core software. The underlying product remains open source, so the cost change is mainly the subscription and the support terms rather than a different identity engine. Red Hat's product page showed version 26.6 as its latest, so confirm the current version and support lifecycle directly with Red Hat.
- Added components: a Red Hat subscription, access to Red Hat's supported builds and packages, and support cases handled by Red Hat.
- Staff skills: the same Keycloak and database skills as the open source option, plus familiarity with Red Hat's packaging and support process.
- Upgrade approach: you follow Red Hat's supported release path, which may lag the upstream project, so plan upgrades around the versions Red Hat supports.
- Subscription option: the recurring fee covers support, patches and a supported build, and its price depends on the subscription tier and the deployment size, which you should request from Red Hat.
- Cost drivers: subscription tier, the number of deployments covered, and how much internal support work you can offload.
Ask Red Hat for the written support terms, the supported database and deployment platforms, and the end-of-support date for the version you plan to run.
How to build your own Cognito cost model
This sequence turns Cognito's pricing into a three-year cost comparison against a self-hosted Keycloak estate sized for the same users. The output is a side-by-side model with one-time and recurring costs, a growth test, and quotes you can check against.
Export current user counts from Cognito
Pull the monthly active user count for each month of the past year from the Cognito console or your billing data, and separate direct users from federated users who sign in through SAML or OIDC identity providers. Record the peak month as well as the average, because the bill follows the highest billable count in your billing period. Done when you have a table of monthly figures for both user types, with the source of each number noted.
Pull current rates from the AWS pricing page
Open the Amazon Cognito pricing page for your AWS Region and note the rate for each tier you are considering (Lite, Essentials and Plus), the free tier allowance, and the separate rate for federated SAML and OIDC users. Record the pricing date and currency, since AWS changes rates over time. Done when every rate in your model cites the page and date it came from, and you have confirmed whether your current feature needs require Essentials or Plus.
List the AWS services your user pool depends on
Identify every AWS service tied to login: Lambda triggers, API Gateway or Application Load Balancer, WAF, CloudWatch logs, SES or SNS for email and SMS, KMS keys and any custom domain certificates. Check which services you would still pay for after moving, such as the application's own hosting. Done when you have a list with each service's current monthly cost and a note on whether it stays, goes or is replaced.
Size a Keycloak estate for the same users
Using the same user counts and growth assumptions, size the infrastructure: application nodes for at least two instances, a production PostgreSQL database that Keycloak supports, load balancing, and separate environments for staging and recovery. Keycloak's high availability designs require a synchronously replicated database, so price that tier explicitly. Done when you have an architecture sketch and a bill of materials with the instance types, storage and network components priced from your cloud provider or data center.
Cost the operating work, backups and monitoring
Add recurring lines for backups and tested restores, monitoring and alerting, certificate and secret management, and patching. Keycloak's own guidance is that realm export and import is limited as a backup method and requires all nodes to be stopped, so budget for a separate backup approach. Estimate staff time in hours per month for upgrades, which arrive on a regular release cadence, and for on-call coverage. Done when every recurring operating task has an owner, an hours estimate and a rate taken from your own payroll or contractor figures.
Add one-time migration and implementation costs
List the one-time work: export of users, realm and client mapping, testing, cutover, and decommissioning of the Cognito pool. Cognito does not export password hashes, so include the cost of forced password resets or sign-in-time migration. Add implementation and hardening if you use a partner. Ask each partner for a written, fixed-scope quote that lists deliverables and exclusions, and ask whether ongoing support and upgrades are priced separately. Done when each one-time item has a quote or internal estimate attached.
Run both totals over three years and test growth
Total the Cognito bill and the Keycloak estate over 36 months, keeping one-time and recurring costs in separate rows. Then rerun the model at two or three user growth rates, including one that doubles the user count, and mark where the lines cross. Label all growth numbers as illustrative unless they come from your own forecast. Done when the spreadsheet shows both totals per year, the break-even point under each growth case, and a list of the quotes still outstanding before a decision.
Does self-hosting Keycloak cut Amazon Cognito cost for a small team?
Is self-hosting Keycloak cheaper than Cognito for a small user base?
Not automatically. Keycloak is Apache 2.0 licensed, so there is no license fee, but you pay for the infrastructure around it: compute, a supported PostgreSQL database, backups, monitoring, and at least two nodes if you need high availability. Those costs are mostly fixed, so at small monthly active user counts the per-user Cognito charge may be lower than the combined cost of hosting and staff time. Check current Cognito tier and federated user prices on the AWS pricing page for your Region, then model both options over the same period, including the engineering hours that Keycloak adds.
How long does a Keycloak deployment and migration take?
The duration depends on scope, and no fixed timeline applies to every team. The main drivers are the number of realms, clients and identity sources such as LDAP or Active Directory, the high availability design, the database setup, how users move across, and how many applications need regression testing. Keycloak's high availability designs require a synchronously replicated database, which adds build and test work. Ask for the timeline in the written scope, with each phase, its entry and exit criteria, and the assumptions behind it.
Can an in-house team run Keycloak without outside help?
Many teams can, provided they already operate PostgreSQL, TLS, containers or Kubernetes, and identity protocols. Keycloak's operator is installed through Operator Lifecycle Manager and its documentation recommends manual approval for operator updates, so someone must review each upgrade. Since Keycloak 26.0 the project plans four minor releases a year and a major release every two to three years. Before you decide, confirm who handles on-call, who reviews each release, and who tests applications after an upgrade.
What skills and hours does a Keycloak migration need?
The work needs several skill sets at once:
- Identity protocols, including OpenID Connect, OAuth 2.0 and SAML 2.0
- PostgreSQL administration, backup and restore
- Container or Kubernetes operations, plus monitoring with Keycloak's metrics
- Application integration and test automation
Hours depend on the number of applications, any custom login logic, and the test plan, and no supplied figure sets them for your environment. Note that Keycloak's realm export is not a complete backup mechanism and requires all nodes to be stopped, so the backup design must be planned as part of the work. Request an effort estimate by skill set in the quote.
Why does the Cognito migration cost depend on password hashes?
Cognito does not export password hashes in its user export, so user passwords cannot move directly into Keycloak. You then choose between two paths. Forced password resets are simpler to build but add support load and friction for users. A sign-in-time migration verifies each password against Cognito on the user's next login, then stores it in Keycloak, which requires the old user pool to stay live until most accounts have moved. Each path carries different build, testing and running costs, so ask the provider to price both and to state which one the quote assumes.
Should we buy a support subscription or a retainer for Keycloak?
They cover different things. A support subscription, such as one for the Red Hat build of Keycloak, is a vendor agreement for a supported distribution of the open-source project, and you still operate the system. A retainer with DeployOpen covers ongoing services that you agree in writing, such as upgrades, testing, backup checks and support. Compare response times, covered versions, patch handling, what is included in upgrades, and who carries the on-call duty. Confirm the terms of each before comparing prices, since they rarely cover the same work.
What should a written quote for Keycloak include?
A useful quote lists the scope and environment, including the cloud account, data center or air-gapped network. It should name the realms, clients, identity sources, high availability design and database. It should describe the backup and restore procedure, the migration approach for users, the testing plan, the handover documents, the upgrade policy, and the support hours and response terms. Ask it to separate one-time work from recurring costs, and to list assumptions, exclusions and acceptance criteria. Also confirm that the infrastructure costs are your own and that the quote does not include them.
How DeployOpen scopes a fixed-price Keycloak cost and migration plan
DeployOpen plans and implements self-hosted Keycloak inside your own cloud accounts, data centers or air-gapped networks, starting from a written scope. The cost comparison against Amazon Cognito is worked out component by component so that your team can check each line before any work begins.
How we scope
- We list your current Cognito user pools, MAU counts by month, and any SAML or OIDC federated users you pay for separately.
- We agree which Keycloak components are in scope, including database, high availability design, backups, monitoring and upgrade approach.
- Engagements are fixed-scope, so deliverables and timelines are agreed in writing before work starts, and the quote follows from that scope.
How we build
- We size and deploy Keycloak on your infrastructure, with a supported production database such as PostgreSQL and a documented high availability design.
- We set up the Keycloak Operator or your chosen deployment method, with manual approval for operator updates to avoid unplanned upgrades.
- We test the deployment, including failover, backup and restore, and the login flows for each application client before cutover.
How we hand over
- We document the architecture, the cost model for your environment, and the runbooks your operations team needs for daily work.
- We provide the migration plan for users, covering whether exports can carry password hashes and whether forced resets or sign-in-time migration fit your apps.
- We deliver the configuration, realm exports and evidence needed for your own compliance reviews, while independent auditors handle any formal assessment.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover, scoped separately from the build.
- Keycloak release planning changes over time, so we review each upgrade path and its breaking changes before applying it in your environment.
- Ask any provider to confirm which Keycloak and database versions they will support, and how backups are taken while the cluster keeps running.
