Amazon Cognito Identity

Connect

Activate your license key and start the emulator with the Vera launcher, as in Activate Pro, then run this in a terminal of its own, from an empty scratch directory. It gives the official AWS CLI dummy credentials and a config file of its own, so no AWS account is needed and your own AWS profile isn't touched.

export VERA_ENDPOINT="http://localhost:5003"
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_REGION=us-east-1 AWS_DEFAULT_REGION=us-east-1
export AWS_SHARED_CREDENTIALS_FILE=/dev/null
export AWS_EC2_METADATA_DISABLED=true
export AWS_PAGER="" AWS_CLI_AUTO_PROMPT=off
unset AWS_PROFILE AWS_DEFAULT_PROFILE
unset AWS_SESSION_TOKEN AWS_SECURITY_TOKEN
unset AWS_WEB_IDENTITY_TOKEN_FILE AWS_ROLE_ARN AWS_ROLE_SESSION_NAME
unset AWS_CONTAINER_CREDENTIALS_FULL_URI
unset AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
cat > vera-aws-config <<'EOF'
[default]
region = us-east-1
output = json
cli_binary_format = base64
s3 =
    addressing_style = path
EOF
export AWS_CONFIG_FILE="$PWD/vera-aws-config"

When you've finished every example in this terminal, close it and delete vera-aws-config, not before.

The emulator serves Cognito Identity’s 2014-06-30 API over the AWS JSON protocol, through the AWS CLI’s cognito-identity commands. This is Cognito Identity, the service for identity pools. Cognito user pools are a separate service, with their own cognito-idp commands, and this page doesn’t cover them.

Pool IDs start with the request’s region, such as us-east-1:29be5d21-2981-0b38-24c2-771116e58928.

Example

Issue seen in Vera 1.2.2

In Vera 1.2.2, GetId failed with HTTP 500 InternalFailure (unauthorized use of script (1:5174)). It also answered HTTP 500 in Vera 1.2.0 preview. The license used for testing gave full access, so a license key doesn’t change it. This example covers pool configuration. Identity issuance, tokens and credentials weren’t established, and those steps stay out until a build is shown to create identities.

Create an identity pool that allows unauthenticated identities, and read its configuration:

POOL_ID=$(aws --endpoint-url "$VERA_ENDPOINT" cognito-identity create-identity-pool \
  --identity-pool-name docs_example_pool --allow-unauthenticated-identities \
  --query IdentityPoolId --output text)
aws --endpoint-url "$VERA_ENDPOINT" cognito-identity describe-identity-pool --identity-pool-id "$POOL_ID"

These are the main fields; the pool ID differs on every run:

Output (selected fields)

{
    "IdentityPoolId": "us-east-1:29be5d21-2981-0b38-24c2-771116e58928",
    "IdentityPoolName": "docs_example_pool",
    "AllowUnauthenticatedIdentities": true,
    "IdentityPoolTags": {}
}

AllowUnauthenticatedIdentities is stored configuration. It doesn’t mean getting an unauthenticated identity works: in Vera 1.2.2, GetId failed.

Read the pool’s roles:

aws --endpoint-url "$VERA_ENDPOINT" cognito-identity get-identity-pool-roles --identity-pool-id "$POOL_ID"

It returns the pool’s ID with no roles, since none are assigned.

To clean up, delete the pool. The command prints nothing.

aws --endpoint-url "$VERA_ENDPOINT" cognito-identity delete-identity-pool --identity-pool-id "$POOL_ID"

Supported features

• Identity pools that allow unauthenticated identities: created, described, updated and deleted, with their roles read. UpdateIdentityPool changed a pool’s name and its unauthenticated-identities setting.
• Listing identities: ListIdentities answers for a pool. The tested pool’s list was empty, since no identity could be created.
• Also served, not yet tested: merging and unlinking developer identities, listing identity pools, principal tag maps and resource tags.

Earlier comparison evidence, from 3 November 2026, covered more than Vera 1.2.0 preview or Vera 1.2.2 could do. A native replay then selected and ran 24 Cognito Identity cases, covering selected user-pool login, developer-identity, role-mapping, token and error paths. Five credential-to-local-STS GetCallerIdentity replays matched, including the assumed role’s name, and selected ListIdentities, UnlinkIdentity and UpdateIdentityPool calls matched recorded AWS responses. Not every case or field matched. That evidence doesn’t establish those workflows in Vera 1.2.2, where GetId failed, as it did in Vera 1.2.0 preview.

Limitations

The main limits are below. A few more apply to every service, and the API coverage notes cover smaller differences.

• No identities in Vera 1.2.2. GetId failed with HTTP 500 InternalFailure (unauthorized use of script (1:5174)), on a full-access license, so identity issuance, OpenID tokens, credentials for an identity and their use with STS weren’t established. It’s a failure in Vera 1.2.2, not a plan limit. GetId also answered HTTP 500 in Vera 1.2.0 preview.
• Configuration, not authentication. Pool configuration doesn’t establish authentication, tokens, role credentials, federation or authorization compatibility.
• IDs belong to the emulator. Pool IDs are the emulator’s own, not AWS identity pools.

API coverage

Every operation in AWS's published 2014-06-30 API (SDK model, botocore 1.43.105), and whether the emulator implements it. Availability combines the earlier implementation inventory with the dated observations below; checking a page's example does not verify every operation. Each note names its evidence first; an observation given without a build or date comes from earlier testing, on 3 November 2026. What the statuses mean

Operation	Status	Notes
CreateIdentityPool	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — created a pool allowing unauthenticated identities, with a generated us-east-1: ID.
DeleteIdentities	Implemented
DeleteIdentityPool	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — deleted the pool, with no output.
DescribeIdentity	Implemented
DescribeIdentityPool	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — returned the pool's ID and name, AllowUnauthenticatedIdentities: true and empty IdentityPoolTags.
GetCredentialsForIdentity	Implemented
GetId	Failed in testing	Local observation: Vera 1.2.2, 8 November 2026 — answered HTTP 500 InternalFailure with unauthorized use of script (1:5174), on a full-access license. Identity issuance, tokens and credentials weren't established. Local observation: Vera 1.2.0 preview, 5 November 2026 — for a pool that CreateIdentityPool had just created, answered HTTP 500 InternalFailure on a full-access license.
GetIdentityPoolRoles	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — returned the pool's ID with no roles, since none were assigned.
GetOpenIdToken	Implemented
GetOpenIdTokenForDeveloperIdentity	Implemented
GetPrincipalTagAttributeMap	Implemented
ListIdentities	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — returned an empty list for a pool with no identities. No identity could be created to list, since GetId fails.
ListIdentityPools	Implemented
ListTagsForResource	Implemented
LookupDeveloperIdentity	Implemented
MergeDeveloperIdentities	Implemented
SetIdentityPoolRoles	Implemented
SetPrincipalTagAttributeMap	Implemented
TagResource	Implemented
UnlinkDeveloperIdentity	Implemented
UnlinkIdentity	Implemented
UntagResource	Implemented
UpdateIdentityPool	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — changed a pool's name and its unauthenticated-identities setting.