Cognito is cheap to start on AWS. Bank journeys need more room.

Amazon Cognito prices user pools per monthly active user across Lite, Essentials and Plus tiers. Midships Keycloak gives you the journey flexibility of a full identity platform, portable across clouds.

Compare five-year cost ↗Build or buy? ↗

At a glance

Midships Keycloak vs Amazon Cognito.

	Amazon Cognito	Midships Keycloak
Pricing basis	Monthly active users; Essentials USD 0.015 and Plus USD 0.020 per MAU above free tiers¹	Annual subscription. No per identity or per device fees
Who operates it	AWS, as a managed service	Your team, Midships Guardian, or both
Where it runs	AWS regions	Any cloud, or on premises
Journeys	Managed login pages and Lambda triggers	Full authentication journeys, built with Caravel to Midships standards
Standards	OIDC, OAuth 2.0, SAML 2.0 federation	OIDC, OAuth 2.0, SAML 2.0²
Exit	Re-implement on another platform	Open source core you can keep running without Midships

As at October 2026. Numbered references link to the vendor's own documentation below.

01, Cost

Low entry price, linear growth.

Cognito's per MAU prices are low, and for a small application it is hard to beat. At bank scale, millions of monthly active users at a per MAU rate become a material, growing line. The Midships Keycloak subscription does not change with the number of customers who sign in; only the infrastructure scales with load.

02, Flexibility

Journeys are where banks differ.

Step-up authentication, delegated access, device binding and regulator-specific consent flows are where bank identity is won or lost. Midships Keycloak gives you full journey control, built from specification with Caravel and tested the same way every time.

Verdict

Which is right for you?

Choose Amazon Cognito if

you are AWS-only, your journeys are simple, and your active user numbers are modest.

Choose Midships Keycloak if

you need complex bank journeys, portability across clouds or on premises, and predictable cost at scale.

Common questions

Frequently asked questions.

Can Keycloak run on AWS?

Yes. Midships Keycloak is designed to run on Kubernetes in your own AWS account, on other major clouds, or on premises.

Sources

How we sourced this comparison.

Statements about other vendors come from their public documentation and pricing pages, checked in October 2026. Vendors change products and prices; confirm current terms with them. Product names are trademarks of their owners and are used only to identify those products. If you believe anything here is inaccurate, tell us at sales@midships.io and we will correct it.

More comparisons