Almost every developer building web and mobile apps hits the same sequence of mistakes: first hardcoding passwords plaintext in user tables, learning hashing and using bcrypt, then implementing password reset, email verification, MFA, social login, token expiry, refresh-token rotation — eventually asking "why am I building all this?" Authentication and authorization are security's most fragile domains; homegrown systems almost always have gaps somewhere. Amazon Cognito manages this entire "don't build it yourself" realm as a service.
Cognito is tricky in DVA-C02 because two separate components (User Pool and Identity Pool) coexist with confusing names