Topic starter
06/07/2026 9:46 am
TL;DR: OIDC federation can add passkeys to Amazon Cognito without core app changes, while also exposing a hidden identity-merge problem when password users and passkey users collide in the same user pool, according to Descope. The real governance issue is not login convenience, but preserving account continuity, role mapping, and lifecycle control across federated identities.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “How to Add Passkeys to Amazon Cognito Using Descope”.
Key questions
Q: What breaks when passkeys are added to an existing Cognito user pool without identity merge logic?
A: Duplicate accounts can appear when Cognito treats a federated passkey user as new even though a password-based account already exists.
Q: Why do passkeys improve security but still require IAM governance?
A: Passkeys improve security by reducing phishing and secret theft, but IAM governance is still required because identity risk moves to enrollment, device trust, and recovery.
Q: How can security teams tell whether passkey and password identities are being merged correctly?
A: Look for consistent account attributes, preserved role mappings, and a single audit trail after a user switches authentication methods.
Practitioner guidance
- Define identity linking rules before rollout Specify which attribute, usually verified email, determines whether a federated passkey user maps to an existing Cognito principal or a new account.
- Treat merge Lambda as privileged identity code Scope the Lambda role to only the Cognito actions needed for linking and auditing user identities.
- Preserve role and permission continuity through federation Check that custom claims, role mappings, and tenant attributes survive the OIDC handoff and are not lost when the user is linked back to the Cognito record.
Bottom line: Passkeys improve Cognito authentication, but the deeper governance issue is whether federated and local identities resolve to one authoritative account.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 10:02 am
Identity merge is now the real governance boundary: The article shows that passkeys do not eliminate the account-continuity problem, they move it to reconciliation. When a federated identity lands in a Cognito pool that already contains a password-based account, the control question becomes whether the organisation can prove it is the same principal. The implication is that authentication modernization without merge governance produces duplicate identities, not cleaner identity.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What is the difference between authentication and identity reconciliation in OIDC federation?
A: Authentication proves the user at sign-in. Identity reconciliation decides whether that proof should attach to an existing principal, create a new one, or link two records without changing the user’s access scope.
👉 Read our full editorial: Passkeys in Amazon Cognito expose the hidden IAM merge gap