> I’ve got by with paying for compute, network, and storage on the barebones services.

Yes, as I mentioned, that type of migration isn't difficult, which is akin to migrating to a different model provider, but that's not what we're discussing. You can't hand wave the issue away if you're not even talking about the the topic at hand.

That said, I agree with your suspicions of how it'll shake out in the end, because most businesses behave the same way, and always try and lock-in their customers.

not the op, but I suspect they were meaning it's a huge pain migrating to a different cloud provider when all those features mentioned are in use. not that managing them is a mess in AWS.

However if I only expect to have a handful of (lucrative) users, it's not the worst idea. The other reason to use Cognito is that AWS handles all the user login issues, and costs very few lines of code to use on my end. The fatal security issue is getting hacked, either the platform as a whole, eg S3 bucket with bad perms or user login getting leaked and reused. While obviously no system is unhackable, the gamble is if a homegrown system is more impervious than Cognito (or someone else's eg Supabase). With a large development team where the login system and overall system security isn't going to be an afterthought, I wouldn't think about using Cognito, but where both of those things are an afterthought, I'd at least consider Cognito, or some other managed system.

The ultimate problem with Cognito though is the vendor lock in. (Last I checked, which was years ago) in order to migrate users out, they have to reset their password which would cause users to bounce off your service instead of renewing their subscription.