title: Should I store failed login attempts in AWS Cognito or Dynamo DB?
body: <p>I have a requirement to build a basic "3 failed login attempts and your account gets locked" functionality. The project uses AWS Cognito for Authentication, and the Cognito PreAuth and PostAuth triggers to run a Lambda function look like they will help here.</p>
  
  <p>So the basic flow is to increment a counter in the PreAuth lambda, check it and block login there, or reset the counter in the PostAuth lambda (so successful logins dont end up locking the user out). Essentially it boils down to:</p>
  
  <p><strong>PreAuth Lambda</strong></p>
  
  <pre><code>if failed-login-count &gt; LIMIT:
      block login
  else:
      increment failed-login-count
  </code></pre>
  
  <p><strong>PostAuth Lambda</strong></p>
  
  <pre><code>reset failed-login-count to zero
  </code></pre>
  
  <p>Now at the moment I am using a dedicated DynamoDB table to store the failed-login-count for a given user. This seems to work fine for now.
  Then I figured it'd be neater to use a custom attribute in Cognito (using <code>CognitoIdentityServiceProvider.adminUpdateUserAttributes</code>) so I could throw away the DynamoDB table.</p>
  
  <p>However reading <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-dg.pdf" rel="nofollow noreferrer">https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-dg.pdf</a> the section titled "Configuring User Pool Attributes" states:</p>
  
  <blockquote>
    <p>Attributes are pieces of information that help you identify individual users, such as name, email, and phone number. Not all information about your users should be stored in attributes. For example, user data that changes frequently, such as usage statistics or game scores, should be kept in a separate data store, such as Amazon Cognito Sync or Amazon DynamoDB.</p>
  </blockquote>
  
  <p>Given that the counter will change on every single login attempt, the docs would seem to indicate I shouldn't do this...</p>
  
  <p>But can anyone tell me why? Or if there would be some negative consequence of doing so?
  As far as I can see, Cognito billing is purely based on storage (i.e. number of users), and not operations, whereas Dynamo charges for read/write/storage.
  Could it simply be AWS not wanting people to abuse Cognito as a storage mechanism? Or am I being daft?</p>