Opt in at the user-pool level
Amazon Cognito announced user-pool session management on November 11. It is available in the Essentials and Plus feature plans in all AWS Regions where Cognito is available. Session tracking is off by default and must be enabled for the user pool.
The feature distinguishes browser-based single sign-on sessions created through managed login from token sessions associated with an app client. Refreshing or rotating tokens extends the existing token session rather than creating a new session. Machine-to-machine client-credentials tokens are not tracked.
What developers can build
Session records include the app client, device type, initial sign-in and last-activity times, plus IP-derived location. Users can list and revoke their own sessions; administrators have separate operations authorised with AWS identity credentials. Applications can use those records to build session-visibility and remote sign-out controls.
Revocation can target an individual session. Linked-session behaviour depends on whether the target is a token or SSO session, so developers should check the guide before treating one revocation as a sign-out everywhere. Global sign-out ends all of that user’s tracked SSO and token sessions.
Limits and settings to check
The default active-token-session limit is 20 per user and can be configured up to 100. When a new sign-in reaches the cap, Cognito revokes the least recently used session rather than rejecting the new sign-in.
App clients can also configure SSO reuse instead of relying on the previous fixed one-hour duration. Multi-Region session counts are eventually consistent, so the cap can briefly be exceeded by near-simultaneous sign-ins in different Regions. Review the official configuration and revocation rules before enabling the feature.
