Skip to main content

Cognito plugin


Usage: ds-load-cognito <command>

Cognito directory loader

version version information
fetch fetch cognito data
transform transform cognito data
export-transform export default transform template
exec fetch and transform cognito data
verify verify fetcher configuration and credentials

-h, --help Show context-sensitive help.
-c, --config=CONFIG-FLAG Configuration file path
-v, --verbosity=INT Use to increase output verbosity.

Run "ds-load-cognito <command> --help" for more information on a command.


The Cognito plugin supports the following arguments:

  -k, --access-key=STRING      AWS Access Key ($AWS_ACCESS_KEY)
-s, --secret-key=STRING AWS Secret Key ($AWS_SECRET_KEY)
-p, --user-pool-id=STRING AWS Cognito User Pool ID ($AWS_COGNITO_USER_POOL_ID)
-r, --region=STRING AWS Region ($AWS_REGION)
-g, --[no-]groups Retrieve Cognito groups ($AWS_COGNITO_GROUPS)


The Cognito plugin can retrieve both users and groups, and transform these into directory user objects, identity objects, group objects, and relationships between these.

To export the default transform, use:

ds-load cognito export-transform

You can use this as the basis for your own transform, which can be tweaked for a different mapping between Cognito and directory objects and relations.

To learn about the transformation language, refer to the transform docs.