AWS Cognito: Difference between Cognito ID and sub, what should I use as primary key?

Question

Im building a serverless backend using AWS Cognito for user administration.

Cognito uses both cognitoId and sub to identify a user.

This project from the official awslabs uses the cognitoId as primary key in the database tables to link data to a user object, but the documentation about sub clearly states:

sub: the UUID of the authenticated user. This is not the same as username.

Question: What should I use as primary key, cognitoID or sub?

Answer 1

The naming can get confusing, I'll try to clarify.

There are typically two pools under the umbrella of Amazon Cognito:

• User Pool
• Identity Pool (Federated Identities)

The "sub" that you are referring to is typically expressed in IAM Policies as

${cognito-identity.amazonaws.com:sub}

and will resolve to the value found in (in the javascript sdk)

AWS.config.credentials.identityId

which will look something like

us-east-1:########-####-####-####-############

It will only exist on the credentials once the credentials have been refreshed.

So to answer you question, the sub.