Can you please expand on that recommendation? I tried and found it profoundly opaque, and eventually gave up in favour of auth0. I specifically wanted to use the hosted login/sign-up forms.
It lays out the architecture fairly well and how Cognito ties into it. Still very fiddly, and doesn't give any indication on how to use their hosted forms (which are a bit of a mystery to me as well).
Since it's still on point with the OP's question, I'll ask: What has your experience been with auth0? It's another service I have considered.
The thing I spend the most time on was "user_metadata" and "app_metadata", two JSON blobs on each user, RW and RO respectively. In order to read those at all from your application, you have to define a custom "rule" (arbitrary Javascript that wraps responses). The reason for this is something about standards and name-spacing, but I couldn't really follow the argument, and it's seems like this is something that very confusing to a lot of users.
[0]: https://stackoverflow.com/questions/45828654/aws-cognito-use...