Lao Chen asked me about login for his mini-program
Last week Lao Chen messaged me on WeChat: "Our mini-program needs user login — is AWS Cognito okay?" My stomach dropped. I'd been there in 2023.
I was building the user system for a mental health counseling mini-program. Picked AWS's setup without thinking. By week two, I realized even one thing — "send a verification email after signup" — meant writing a Lambda function (a small bit of code that runs in the cloud), setting IAM permissions (basically a list of "who can touch what resources"), and digging through CloudWatch logs (Amazon's error record book). I wasn't a coder yet. The docs made me want to cry.
What is Cognito? Who's getting burned?
AWS Cognito is Amazon's "user login kit" — handles signup, login, password reset, multi-device login, WeChat/Google third-party login. Sounds like it does everything, right?
Josh Karamuth posted a rant on Hacker News called "I used AWS Cognito for a startup. I wouldn't do it again" — 130 points, 103 comments. He's at a small B2B SaaS team in San Francisco, needed 5 role permissions on the admin dashboard. Cognito made him wrestle with IAM, Lambda, and CloudFormation (Amazon's config files). Three engineers spent two months barely shipping it.
For us non-coder founders, that's basically asking us to fly a plane.
Cost to replicate today
Money: Cognito is free up to 50,000 MAU (monthly active users — "people who logged in that month"). Beyond that, about $0.005 per user. Looks cheap.
Time: get "signup + email verification + login" working — 1-2 weeks if you know what you're doing; 3-6 weeks for newbies. I lost a full three months.
Technical bar: AWS console, IAM permission roles, Lambda functions, CloudWatch logs. Basically you need to be half a backend engineer first.
First step: log into aws.amazon.com → search "Cognito" at the top → click "Create user pool." If that page already makes you dizzy, just close it. That's normal.
How to pick at different stages
If you're just starting out with barely any users: use WeChat mini-program's built-in login + one Tencent Cloud Function. Half an hour, zero cost. Don't touch AWS.
If you already have 1-2 clients, doing a real Web/App: use Clerk (free up to 10k users/month, point-and-click setup) or Supabase Auth (open-source, 100k monthly calls free at signup). Works out of the box, no code.
If you're scaling and need SSO (employees log in with their company email) and granular permissions: then consider Cognito or Auth0 — by then you'll have an engineering team who can handle it. Don't test it now. Don't dig the hole early.