awsJun 3, 2026

Improve your application resilience with Amazon Cognito multi-Region replication | Amazon Web Services (opens in new tab)

Amazon Cognito multi-Region replication improves authentication resilience by maintaining synchronized user data, credentials, configurations, and machine secrets in a secondary AWS Region. During a regional outage, applications can redirect traffic while users continue using existing credentials and sessions, though registration and profile updates are unavailable during failover. The feature also adds customer managed AWS KMS keys for consistent, customer-controlled encryption across Regions. ## Challenges with Regional Failover - Custom replication solutions previously required significant engineering effort. - Manual user-data transfers introduced security and consistency risks. - Users could be forced to reset passwords or authenticate again after a regional switch. - Machine-to-machine systems required new app clients, application reconfiguration, and updated OAuth resource trust settings. ## How Multi-Region Replication Works - Replication is one-way, from a primary Region to a secondary Region. - The replica includes: - User profiles and credentials - User pool configuration - Machine-to-machine secrets - The secondary pool is read-only and remains available for authentication. - Existing sessions continue uninterrupted. - Users can authenticate with existing credentials, and either Region recognizes access tokens issued by the other. - Supported authentication methods include: - Social identity providers - SAML and OIDC federation - API authorization flows - Machine-to-machine authentication - New registrations and profile changes are unavailable while operating from the replica. ## Customer Managed KMS Keys - A multi-Region customer managed key is required before replication can be configured. - The key must be replicated into both the primary and secondary Regions. - Its policy must grant Amazon Cognito permission to use the key. - Customer managed keys provide consistent encryption across Regions and greater control over encryption policies. ## Configuration Process - The console guides administrators through three main steps: - Select and configure the customer managed KMS key. - Configure multi-Region OIDC issuer endpoints. - Select and create the replica Region. - Client applications must be updated with the new OIDC endpoints. - Server-side applications require redeployment, while mobile applications require updated store submissions. - After the replica is prepared, an administrator must manually activate it. ## Additional Regional Resources - Lambda functions used for custom authentication, SMS, or email must be deployed and configured in the secondary Region. - Logging and AWS WAF settings must also be recreated there. - Teams should verify that all supporting authentication infrastructure is available before failover. ## Health Checks and Failover - Both regional endpoints remain active and ready to serve traffic. - Applications should define health checks based on error rates, latency, or service alerts. - DNS can redirect traffic to the secondary Region when failover criteria are met. - Teams should test failover during low-traffic periods, potentially routing only a small percentage of traffic initially. - Managed login and federation with custom domains can use Amazon Route 53 health checks for built-in traffic routing. ## Pricing and Availability - Replication is available as an add-on for Cognito Essentials and Plus tiers. - User authentication costs: - $0.0045 per monthly active user per replica Region for Essentials - $0.006 per monthly active user per replica Region for Plus - M2M replication adds 30% to standard successful-token pricing. - The feature is available across selected Regions in North America, Europe, Asia Pacific, Canada, Africa, and South America. Organizations needing resilient authentication should pair Cognito replication with multi-Region KMS keys, replicated supporting services, tested health checks, and an automated or well-practiced DNS failover process.

aws-kmsaws-lambdaoauthsaml+4

awsFeb 3, 2026

AWS IAM Identity Center now supports multi-Region replication for AWS account access and application use | Amazon Web Services (opens in new tab)

AWS IAM Identity Center now supports multi-Region replication for organizations using an external identity provider such as Microsoft Entra ID or Okta. Workforce identities, permission sets, and related metadata can be replicated from a primary Region, allowing users to access AWS accounts and managed applications if the primary service is disrupted. The feature also supports regional application deployment for improved performance and data residency compliance, with centralized configuration remaining in the primary Region. ## Multi-Region Replication and Resilience - Replication provides an active AWS access portal endpoint in each additional Region. - Users can continue accessing AWS accounts with already-provisioned permissions during a primary-Region disruption. - AWS managed applications can access replicated identities locally, improving reliability and proximity to users or datasets. - IAM Identity Center configuration remains centrally managed from the primary Region. ## Prerequisites and Setup - The feature requires: - An organization instance of IAM Identity Center. - An external IdP, such as Okta or Microsoft Entra ID. - Primary and additional Regions that are enabled by default. - Before replication, the customer-managed AWS KMS key must be replicated to the target Region. - AWS recommends multi-Region KMS keys because they maintain consistent key material across Regions while preserving independent regional infrastructure. - In the IAM Identity Center console, administrators select **Settings → Management → Add Region** and choose the target Region. - Initial replication time depends on the size of the Identity Center instance. ## User Authentication and Access - Administrators must add the additional Region’s SAML Assertion Consumer Service (ACS) URL to the external IdP configuration. - A bookmark application can be created in the IdP to provide users with direct access to the new Region’s AWS access portal. - Users can access accounts and applications through existing methods, including: - The AWS access portal - Application links - The AWS CLI ## Regional Application Deployment - AWS managed applications can be deployed in additional Regions using existing deployment workflows. - Organizations can place applications near regional datasets to satisfy performance or data residency requirements. - Administrators should verify that each required managed application supports both the selected Region and multi-Region deployment. ## Operational Considerations - Additional Regions provide a limited-management console experience. - Most operations outside the primary Region are read-only, except application management and user session revocation. - Workforce activity is recorded in AWS CloudTrail in the Region where it occurs. - Break-glass access is recommended for privileged users if the external IdP becomes unavailable. - Account instances, Microsoft Active Directory identity sources, and the built-in IAM Identity Center directory are not supported at launch. ## Availability and Cost - The feature is available at no additional IAM Identity Center cost in 17 enabled-by-default commercial AWS Regions. - Standard AWS KMS charges apply for customer-managed key storage and use. Organizations using supported external IdPs should replicate IAM Identity Center into strategically selected Regions, configure the required KMS replicas and ACS URLs, and test regional access and emergency procedures before relying on the setup for disaster recovery.

aws-kmssamlsingle-sign-onidentity-and-access-management+4