--- title: "AWS Cognito Integration" description: "Connect AI agents to Amazon Cognito User Pools. Agents provision and de-provision users, manage passwords and attributes, run role-based group membership, and inspect user pools and app clients." url: https://flowrunner.ai/integrations/aws-cognito date_modified: 2026-08-01T02:40:32-07:00 --- # AWS Cognito [Identity & Security](https://flowrunner.ai/integrations/category/identity-security) Connect AI agents to Amazon Cognito User Pools. Agents provision and de-provision users, manage passwords and attributes, run role-based group membership, and inspect user pools and app clients. [Verified](https://flowrunner.ai/integrations/verified "What does verified mean?") · 22 actions · API key · available [AWS Cognito website](https://aws.amazon.com/cognito/) · [Platform Documentation](https://docs.aws.amazon.com/cognito/latest/developerguide/what-is-amazon-cognito.html) · Capability data verified 2026-07-14 1. A new-customer signup event starts an account-provisioning flow 2. Agent reads the customer's email, name, and initial attributes 3. Admin Create User in the target user pool with those attributes 4. Agent confirms the user was created and reads back the status 5. Agent verifies the correct groups exist before assigning membership 6. A personalized welcome is sent to the new user 7. Ops confirms an account deprovision before the agent disables and deletes it ## What This Integration Enables Agents provision and de-provision users in a user pool (create, confirm, enable, disable, delete), manage passwords administratively by setting a permanent or temporary password or triggering a reset, read and update user attributes as part of an automated onboarding or sync flow, search and paginate through a pool's members with attribute filters, manage groups and group membership for role-based access, and discover user pools and app clients to inspect their configuration. User attributes are supplied and returned as plain JSON keyed by attribute name, and the connector converts to and from Cognito's attribute-value format automatically. All admin operations authenticate with IAM credentials, so no end-user access token is involved. The connector covers the Cognito User Pools admin surface; the surrounding flow decides which provisioning steps run automatically and where a human confirms an account is safe to disable or delete. ### Without FlowRunner **Manual account setup**: New users are created in the console one at a time, with attributes entered by hand **Inconsistent group roles**: Group membership is assigned ad hoc, so role-based access drifts over time **Risky cleanup**: Disabling or deleting stale accounts is done manually, with no record of the roles removed ### With FlowRunner **Provisioning in flow**: Admin Create User sets attributes and status as a workflow step for every signup **Role-based membership**: Group operations keep membership consistent with a documented trail **Gated deprovision**: A user's groups are recorded, then the account is disabled and deleted on a human's confirmation ## Use Case Scenarios ### New-customer provisioning tied to billing A new signup starts the flow. The agent sets up billing with [Stripe](https://flowrunner.ai/integrations/stripe), then calls Admin Create User to provision the Cognito account with the customer's email and attributes, and sends a personalized welcome. The account and the billing record are created together in one flow, so a paying customer never lands without a login or a login without a billing record. ### Inactive-account cleanup On a routine, the agent calls List Users with an attribute filter to find inactive or unconfirmed accounts. For each match it records the user's groups with Admin List Groups For User, then, on confirmation, calls Admin Disable User and reports the cleanup to the ops channel with [Slack](https://flowrunner.ai/integrations/slack). Disabling is reversible, so the pool stays clean without an irreversible delete happening on a filter match alone. ### Offboarding with role capture An offboarding trigger starts the flow. The agent calls Admin List Groups For User to record exactly which roles the departing user held, then Admin Remove User From Group for each one and Admin Delete User to fully de-provision the account. The captured roles give the team a record of what access existed, which matters when the offboarding is later reviewed. ## Human-in-Loop Highlight Deleting a user is irreversible, so the agent stops before it. During inactive-account cleanup or offboarding, the agent does the safe and reversible work on its own: it filters the pool, records the user's group memberships, and disables the account. Before it calls Admin Delete User, it pauses and asks the ops owner through Slack: "Found \[count\] inactive accounts. \[user\] last active \[date\], held groups \[list\], now disabled. Delete permanently, keep disabled, or reinstate?" The owner decides. The agent handles the filtering and the reversible disable; the person owns the permanent removal. Agent processes routinely Detects exception requiring judgment Clear match Continues automatically Ambiguous Routes to human via Slack Human decides Agent resumes with decision ## Agent Capabilities 19 actions ### User Management 10 - **Admin Create User** Creates a user in a user pool, optionally suppressing or resending the invitation. The core provisioning action. - **Admin Get User** Reads a user's attributes and status. - **List Users** Searches and paginates through a pool's members with attribute filters. Powers cleanup and audit flows. - **Admin Update User Attributes** Updates a user's attributes during onboarding or a sync flow. - **Admin Disable User** Disables a user, blocking sign-in without deleting the account. Reversible, so agents can run it before a human confirms deletion. - **Admin Enable User** Re-enables a previously disabled user. - **Admin Delete User** Permanently removes a user. The typical human-gated step. - **Admin Set User Password** Sets a permanent or temporary password. A permanent password confirms the user immediately. - **Admin Reset User Password** Triggers a password reset for a user. - **Admin Confirm Sign Up** Confirms a user's sign-up administratively. ### Group Management 4 - **Create Group** Creates a group for role-based access. - **Admin Add User To Group** Adds a user to a group to grant its role. - **Admin Remove User From Group** Removes a user from a group. - **Admin List Groups For User** Lists the groups a user belongs to, used to record roles before offboarding. ### User Pools and App Clients 5 - **List User Pools** Discovers the user pools in the configured region. - **Describe User Pool** Inspects a user pool's configuration. - **Create User Pool** Creates a new user pool. - **List User Pool Clients** Lists the app clients registered to a user pool. - **Describe User Pool Client** Inspects an app client's configuration. ## Frequently Asked Questions ### What can FlowRunner do with AWS Cognito? FlowRunner agents can run Admin Create User, Admin Get User, and List Users in AWS Cognito, plus 19 more actions. ### Does connecting AWS Cognito to FlowRunner require OAuth? No. AWS Cognito connects to FlowRunner with an API key, no OAuth flow required. ### Can AWS Cognito trigger a FlowRunner workflow automatically? AWS Cognito doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger. **Work at AWS Cognito?** This integration exposes AWS Cognito to AI agents on every FlowRunner plan, including through MCP, at no cost to you. [See what FlowRunner offers integration partners](https://flowrunner.ai/integrations/partners), including how to keep this page current. --- Markdown version of https://flowrunner.ai/integrations/aws-cognito. Site index: https://flowrunner.ai/llms.txt