AWS Cognito: Difference between Cognito ID and sub, what should I use as primary key?

Question

Im creating a serverless backend using AWS Cognito to administer users.

Cognito uses both cognitoId and sub to identify the user.

This official awslabs project uses cognitoId as the primary key in database tables to bind data to a user object, but the sub documentation clearly states:

sub : UUID of the authenticated user. This is not the same as username .

Question: What should be used as a primary key, cognitoId or sub ?

Answer 1

Naming may be confused, I will try to clarify.

There are usually two pools at Amazon Cognito Zoo:

• User pool
• Identity Pool (Federated Identifiers)

The "Sub" you are talking about is usually expressed in IAM as

$ {cognito-identity.amazonaws.com:sub}

and will solve the value found in (in javascript sdk)

AWS.config.credentials.identityId

which will look something like

we-east-1: ############ - ######## - ############

It will exist only in the credentials as soon as the credentials are updated.

So, to answer your question, sub .

Answer 2

• sub ( sub ject) is globally unique and therefore unique to the user pool.
• Unlike a username that can be reassigned to another user in the user pool, sub is never reassigned.

A source