I've had an AWS account manager suggest to me to use Auth0 rather than Cognito for some scenarios as well.