I am not sure this qualifies as help, but I would advise managing this on your own instead. Cognito does not seem to be well-supported by AWS, and I have found the greatest stability using it for Authentication only. For the price, it is still a steal even if you do nothing with authorization.