# Identity pools console overview
<a name="identity-pools"></a>

Amazon Cognito identity pools provide temporary AWS credentials for users who are guests (unauthenticated) and for users who have been authenticated and received a token. An identity pool is a store of user identifiers linked to your external identity providers.

One way to understand the features and options of identity pools is to create one in the Amazon Cognito console. You can explore the effect of different settings on authentication flows, role-based and attribute-based access control, and guest access. From there, you can proceed to later chapters in this guide and add the appropriate components to your application so that you can implement identity pool authentication.

**Topics**
+ [Create an identity pool](#identity-pools-create)
+ [User IAM roles](#user-iam-roles)
+ [Authenticated and unauthenticated identities](#authenticated-and-unauthenticated-identities)
+ [Activate or deactivate guest access](#enable-or-disable-unauthenticated-identities)
+ [Change the role associated with an identity type](#change-the-role-associated-with-an-identity-type)
+ [Edit identity providers](#enable-or-edit-authentication-providers)
+ [Delete an identity pool](#delete-an-identity-pool)
+ [Delete an identity from an identity pool](#delete-an-identity-from-an-identity-pool)

## Create an identity pool
<a name="identity-pools-create"></a>

**To create a new identity pool in the console**

1. Sign in to the [Amazon Cognito console](https://console.aws.amazon.com/cognito/home) and select **Identity pools**.

1. Choose **Create identity pool**.

1. In **Configure identity pool trust**, choose to set up your identity pool for **Authenticated access**, **Guest access**, or both.

   1. If you chose **Authenticated access**, select one or more **Identity types** that you want to set as the source of authenticated identities in your identity pool. If you configure a **Custom developer provider**, you can't modify or delete it after you create your identity pool.

1. In **Configure permissions**, choose a default IAM role for authenticated or guest users in your identity pool.

   1. Choose to **Create a new IAM role** if you want Amazon Cognito to create a new role for you with basic permissions and a trust relationship with your identity pool. Enter an **IAM role name** to identify your new role, for example `myidentitypool_authenticatedrole`. Select **View policy document** to review the permissions that Amazon Cognito assigns to your new IAM role.

   1. You can choose to **Use an existing IAM role** if you already have a role in your AWS account that you want to use. You must configure your IAM role trust policy to include `cognito-identity.amazonaws.com`. Configure your role trust policy to only allow Amazon Cognito to assume the role when it presents evidence that the request originated from an authenticated user in your specific identity pool. For more information, see [Role trust and permissions](iam-roles.md#role-trust-and-permissions).

1. In **Connect identity providers**, enter the details of the identity providers (IdPs) that you chose in **Configure identity pool trust**. You might be asked to provide OAuth app client information, choose a Amazon Cognito user pool, choose an IAM IdP, or enter a custom identifier for a developer provider.

   1. Choose the **Role settings** for each IdP. You can assign users from that IdP the **Default role** that you set up when you configured your **Authenticated role**, or you can **Choose role with rules**. With a Amazon Cognito user pool IdP, you can also **Choose role with preferred\_role in tokens**. For more information about the `cognito:preferred_role` claim, see [Assigning precedence values to groups](cognito-user-pools-user-groups.md#assigning-precedence-values-to-groups).

      1. If you chose **Choose role with rules**, enter the source **Claim** from your user's authentication, the **Operator** that you want to compare the claim by, the **Value** that causes a match to this role choice, and the **Role** that you want to assign when the **Role assignment** matches. Select **Add another** to create an additional rule based on a different condition.

      1. Choose a **Role resolution**. When your user's claims don't match your rules, you can deny credentials or issue credentials for your **Authenticated role**.

   1. Configure **Attributes for access control** for each IdP. Attributes for access control maps user claims to [principal tags](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html) that Amazon Cognito applies to their temporary session. You can build IAM policies to filter user access based on the tags that you apply to their session.

      1. To apply no principal tags, choose **Inactive**.

      1. To apply principal tags based on `sub` and `aud` claims, choose **Use default mappings**.

      1. To create your own custom schema of attributes to principal tags, choose **Use custom mappings**. Then enter a **Tag key** that you want to source from each **Claim** that you want to represent in a tag.

1. In **Configure properties**, enter a **Name** under **Identity pool name**.

1. Under **Basic (classic) authentication**, choose whether you want to **Activate basic flow**. With the basic flow active, you can bypass the role selections you made for your IdPs and call [AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) directly. For more information, see [Identity pools authentication flow](authentication-flow.md).

1. Under **Tags**, choose **Add tag** if you want to apply [tags](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html) to your identity pool.

1. In **Review and create**, confirm the selections that you made for your new identity pool. Select **Edit** to return to the wizard and change any settings. When you're done, select **Create identity pool**.

## User IAM roles
<a name="user-iam-roles"></a>

An IAM role defines the permissions for your users to access AWS resources, like [Amazon Cognito Sync](cognito-sync.md). Users of your application assume the roles you create. You can specify different roles for authenticated and unauthenticated users. To learn more about IAM roles, see [IAM roles](iam-roles.md).

## Authenticated and unauthenticated identities
<a name="authenticated-and-unauthenticated-identities"></a>

Amazon Cognito identity pools support both authenticated and unauthenticated identities. Authenticated identities belong to users who are authenticated by any supported identity provider. Unauthenticated identities typically belong to guest users.
+ To configure authenticated identities with a public login provider, see [Identity pools third-party identity providers](external-identity-providers.md).
+ To configure your own back-end authentication process, see [Developer-authenticated identities](developer-authenticated-identities.md).

## Activate or deactivate guest access
<a name="enable-or-disable-unauthenticated-identities"></a>

 Amazon Cognito identity pools guest access (unauthenticated identities) provides a unique identifier and AWS credentials for users who do not authenticate with an identity provider. If your application allows users who do not sign in, you can activate access for unauthenticated identities. To learn more, see [Getting started with Amazon Cognito identity pools](getting-started-with-identity-pools.md).

**To update guest access in an identity pool**

1. Choose **Identity pools** from the [Amazon Cognito console](https://console.aws.amazon.com/cognito/home). Select an identity pool.

1. Choose the **User access** tab.

1. Locate **Guest access**. In an identity pool that doesn't currently support guest access, **Status** is **Inactive**.

   1. If **Guest access** is **Active** and you want to deactivate it, select **Deactivate**.

   1. If **Guest access** is **Inactive** and you want to activate it, select **Edit**.

      1. Choose a default IAM role for guest users in your identity pool.

        1. Choose to **Create a new IAM role** if you want Amazon Cognito to create a new role for you with basic permissions and a trust relationship with your identity pool. Enter an **IAM role name** to identify your new role, for example `myidentitypool_authenticatedrole`. Select **View policy document** to review the permissions that Amazon Cognito assigns to your new IAM role.

        1. You can choose to **Use an existing IAM role** if you already have a role in your AWS account that you want to use. You must configure your IAM role trust policy to include `cognito-identity.amazonaws.com`. Configure your role trust policy to only allow Amazon Cognito to assume the role when it presents evidence that the request originated from an authenticated user in your specific identity pool. For more information, see [Role trust and permissions](iam-roles.md#role-trust-and-permissions).

        1. Select **Save changes**.

        1. To activate guest access, select **Activate** in the **User access** tab.

## Change the role associated with an identity type
<a name="change-the-role-associated-with-an-identity-type"></a>

Every identity in your identity pool is either authenticated or unauthenticated. Authenticated identities belong to users who are authenticated by a public login provider (Amazon Cognito user pools, Login with Amazon, Sign in with Apple, Facebook, Google, SAML, or any OpenID Connect Providers) or a developer provider (your own back-end authentication process). Unauthenticated identities typically belong to guest users.

For each identity type, there is an assigned role. This role has a policy attached to it that dictates which AWS services that role can access. When Amazon Cognito receives a request, the service determines the identity type, determines the role assigned to that identity type, and uses the policy attached to that role to respond. By modifying a policy or assigning a different role to an identity type, you can control which AWS services an identity type can access. To view or modify the policies associated with the roles in your identity pool, see the [AWS IAM Console](https://console.aws.amazon.com/iam/home).

**To change the identity pool default authenticated or unauthenticated role**

1. Choose **Identity pools** from the [Amazon Cognito console](https://console.aws.amazon.com/cognito/home). Select an identity pool.

1. Choose the **User access** tab.

1. Locate **Guest access** or **Authenticated access**. In an identity pool that isn't currently configured for that access type, **Status** is **Inactive**. Select **Edit**.

1. Choose a default IAM role for guest or authenticated users in your identity pool.
**Role manager replaces role options**  
If your account has role manager enabled, Amazon Cognito attaches the role for you. Role manager replaces the **Create a new IAM role** and **Use an existing IAM role** options with **Customize**. To use a different role, choose that option. For more information, see [IAM role creation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) in the *AWS Identity and Access Management User Guide*.

   1. Choose to **Create a new IAM role** if you want Amazon Cognito to create a new role for you with basic permissions and a trust relationship with your identity pool. Enter an **IAM role name** to identify your new role, for example `myidentitypool_authenticatedrole`. Select **View policy document** to review the permissions that Amazon Cognito assigns to your new IAM role.

   1. You can choose to **Use an existing IAM role** if you already have a role in your AWS account that you want to use. You must configure your IAM role trust policy to include `cognito-identity.amazonaws.com`. Configure your role trust policy to only allow Amazon Cognito to assume the role when it presents evidence that the request originated from an authenticated user in your specific identity pool. For more information, see [Role trust and permissions](iam-roles.md#role-trust-and-permissions).

1. Select **Save changes**.

## Edit identity providers
<a name="enable-or-edit-authentication-providers"></a>

If you allow your users to authenticate using consumer identity providers (for example, Amazon Cognito user pools, Login with Amazon, Sign in with Apple, Facebook, or Google), you can specify your application identifiers in the Amazon Cognito identity pools (federated identities) console. This associates the application ID (provided by the public login provider) with your identity pool.

You can also configure authentication rules for each provider from this page. Each provider allows up to 25 rules. The rules are applied in the order you save for each provider. For more information, see [Using role-based access control](role-based-access-control.md).

**Warning**  
Changing the linked IdP application ID in your identity pool prevents existing users from authenticating with that identity pool. For more information, see [Identity pools third-party identity providers](external-identity-providers.md).

**To update an identity pool identity provider (IdP)**

1. Choose **Identity pools** from the [Amazon Cognito console](https://console.aws.amazon.com/cognito/home). Select an identity pool.

1. Choose the **User access** tab.

1. Locate **Identity providers**. Choose the identity provider that you want to edit. If you want to add a new IdP, select **Add identity provider**.

   1. If you chose **Add identity provider**, choose one of the **Identity types** that you want to add.

1. To change the application ID, choose **Edit** in **Identity provider information**.

1. To change the role that Amazon Cognito requests when it issues credentials to users who have authenticated with this provider, choose **Edit** in **Role settings**.
**Role manager replaces role options**  
If your account has role manager enabled, Amazon Cognito attaches the role for you. Role manager replaces the **Create a new IAM role** and **Use an existing IAM role** options with **Customize**. To use a different role, choose that option. For more information, see [IAM role creation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) in the *AWS Identity and Access Management User Guide*.

   1. You can assign users from that IdP the **Default role** that you set up when you configured your **Authenticated role**, or you can **Choose role with rules**. With a Amazon Cognito user pool IdP, you can also **Choose role with preferred\_role in tokens**. For more information about the `cognito:preferred_role` claim, see [Assigning precedence values to groups](cognito-user-pools-user-groups.md#assigning-precedence-values-to-groups).

     1. If you chose **Choose role with rules**, enter the source **Claim** from your user's authentication, the **Operator** that you want to compare the claim by, the **Value** that causes a match to this role choice, and the **Role** that you want to assign when the **Role assignment** matches. Select **Add another** to create an additional rule based on a different condition.

     1. Choose a **Role resolution**. When your user's claims don't match your rules, you can deny credentials or issue credentials for your **Authenticated role**.

1. To change the principal tags that Amazon Cognito assigns when it issues credentials to users who have authenticated with this provider, choose **Edit** in **Attributes for access control**.

   1. To apply no principal tags, choose **Inactive**.

   1. To apply principal tags based on `sub` and `aud` claims, choose **Use default mappings**.

   1. To create your own custom schema of attributes to principal tags, choose **Use custom mappings**. Then enter a **Tag key** that you want to source from each **Claim** that you want to represent in a tag.

1. Select **Save changes**.

## Delete an identity pool
<a name="delete-an-identity-pool"></a>

You can't undo identity pool deletion. After you delete an identity pool, all apps and users that depend on it stop working.

**To delete an identity pool**

1. Choose **Identity pools** from the [Amazon Cognito console](https://console.aws.amazon.com/cognito/home). Select the radio button next to the identity pool that you want to delete.

1. Select **Delete**.

1. Enter or paste the name of your identity pool and select **Delete**.

**Warning**  
When you select the Delete button, you will permanently delete your identity pool and all the user data it contains. Deleting an identity pool causes applications and other services using the identity pool to stop working.

## Delete an identity from an identity pool
<a name="delete-an-identity-from-an-identity-pool"></a>

When you delete an identity from an identity pool, you remove the identifying information that Amazon Cognito has stored for that federated user. When your user requests credentials again, they receive a new identity ID if your identity pool still trusts their identity provider. You can't undo this operation.

**To delete an identity**

1. Choose **Identity pools** from the [Amazon Cognito console](https://console.aws.amazon.com/cognito/home). Select an identity pool.

1. Choose the **Identity browser** tab.

1. Select the checkboxes next to the identities that you want to delete and choose **Delete**. Confirm that you want to delete the identities and choose **Delete**.