2026-06-13 · aws-security
AWS Security Blog detailed a next-generation Amazon Cognito infrastructure that adds high-throughput performance, customer-managed keys for encryption at rest, and multi-Region replication for business continuity. The migration story is especially relevant to preservation planning because AWS describes dual writes, anti-entropy validation, backfill, rollback capability, and shadow-mode validation as safeguards against data loss during modernization.
Amazon Cognito now supports customer-managed keys through AWS KMS and multi-Region replication of user pool data. AWS says the underlying migration covered hundreds of millions of user profiles while maintaining zero downtime.
Identity stores are high-impact preservation targets because they control user access, passwords, attributes, and application availability. A failed migration, compromised key path, or regional outage can lock users out and interrupt critical operations.
Cold storage cannot replace live identity replication, but it can preserve offline exports, configuration snapshots, recovery runbooks, and evidence needed to rebuild access systems. Keeping those materials isolated protects recovery plans from the same failures that damage production identity infrastructure.
Read Original Post →