I went the Cognito route for customer facing, however there were a couple of gotchas: - There's no turn key method for multi-region availability. - It has a l

I went the Cognito route for customer facing, however there were a couple of gotchas: - There's no turn key method for multi-region availability. - It has a limited number of 2FA/MFA options. - It does not offer a SAML idp. We ended up writing a Lambda to issue SAML claims, put it behind an API gateway with Cognito/OIDC authorization. It works, but we'll need to maintian it. - It's AWS, so you'll need a half dozen other services to build a complete solution