A Cognito Federated Identity authentication flow to access AWS services has two forms: classic flow and enhanced flow.

Classic flow can be summarized as follows:

1. The user logs in with an external IDP such as Amazon, Google, or Facebook
2. The IDP returns an OAuth token
3. The client will then make a request to Cognito with the OAuth token
4. Cognito will validate the OAuth token with the IDP and if successful, return a token back
5. The client will then make an AssumeRoleWithWebIdentity call to STS, passing this token
6. STS will validate the token and return with temporary credentials (access key ID and secret access key)
7. The client can now use the temporary credentials to access AWS services

Enhanced flow can be summarized as follows:

1. User logs in with an external IDP such as Amazon, Google, or Facebook
2. The IDP returns an OAuth token
3. The client will then make a request to Cognito with the OAuth token
4. Cognito will validate the OAuth token with the IDP and if successful, return a token back
5. The client will then make a GetCredentialsForIdentity call with Cognito itself
6. Cognito will validate the token, negotiate with STS, and return temporary credentials (access key ID and secret access key)
7. The client can now use the temporary credentials to access AWS services

We followed the enhanced flow in this recipe.