Authentication vs Authorization in AWS Amplify
Authentication vs Authorization in AWS Amplify
Why Permissions Feel Confusing in Amplify
AWS Amplify vs AWS CDK: What Are You Really Choosing? When you start building on AWS, the decision looks simple. You need authentication, APIs, storage, hosting, maybe a few backend functions. Then …

When you start building on AWS, the decision looks simple.
You need authentication, APIs, storage, hosting, maybe a few backend functions.
Then someone says, “Let’s use Amplify.”
Someone else says, “No, let’s build it properly in CDK.”
That’s where the confusion starts.
Because people often compare AWS Amplify and AWS CDK as if they do the same job.
They do not.
AWS Amplify is mainly about helping developers build and ship web and mobile applications faster. AWS CDK is mainly about defining and provisioning AWS infrastructure in code. Those sound close, but they lead to very different ways of building.
AWS Amplify is AWS’s application development platform for building fullstack web and mobile apps. AWS describes it as a way to build backend capabilities, connect them to your frontend, and deploy your application using Amplify Hosting. It supports common frontend and mobile stacks like React, Next.js, Angular, Vue, JavaScript, React Native, Flutter, Android, and Swift.
In practical terms, Amplify gives you a higher-level app-building layer for common product needs: authentication, APIs, storage, functions, hosting, UI components, libraries, and team-friendly workflows. Its feature set includes authentication powered by Amazon Cognito, APIs for GraphQL and REST, Lambda-based functions, storage backed by Amazon S3, hosting with built-in CI/CD, UI components, open-source libraries, and Studio/CLI tooling for managing backend resources and environments.
So when someone says “use Amplify,” what they usually mean is:
“Give me the AWS pieces I need for an app, but don’t make me design every cloud resource from scratch.” That reading is an inference, but it lines up with Amplify’s built-in categories, managed hosting workflow, and higher-level tooling.
AWS CDK, short for AWS Cloud Development Kit, is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. AWS says you can use familiar programming languages like TypeScript, JavaScript, Python, Java, C#/.NET, and Go to create reusable cloud components called constructs, then compose them into stacks and apps.
That means CDK is not really “an app platform” first. It is an infrastructure as code tool first.
You use CDK when you want to define what AWS resources exist, how they are connected, what permissions they have, and how they should be deployed. It also comes with features like reusable constructs, bootstrapped deployment environments, and tools like cdk watch for continuous deploy-and-hotswap workflows during development.
Most teams think this is a tooling choice.
It is actually a choice about how much AWS complexity you want to handle directly.
With Amplify, you start from the needs of an application: sign-in, data, files, frontend hosting, user flows, environments, and team collaboration. With CDK, you start from the needs of the infrastructure: stacks, resources, permissions, deployment patterns, and service composition.
That is the real difference.
Amplify is app-first.
CDK is infrastructure-first.
Amplify is attractive because it reduces setup work for the most common app patterns.
If your team is building a SaaS dashboard, customer portal, internal tool, content app, or mobile app, Amplify gives you a fast path to the things most products need anyway: authentication, storage, APIs, functions, hosting, and UI integration. It also supports managed hosting with CI/CD, open-source frontend libraries, Studio for backend/content management, and CLI workflows for configuring and deploying multiple environments.
This matters a lot for frontend-heavy teams.
Instead of spending days wiring up Cognito, AppSync, API Gateway, Lambda, S3, and deployment flows by hand, you can move faster with prebuilt patterns and then spend more time building product features. That is partly an inference, but it is directly supported by Amplify’s managed auth, API, function, storage, hosting, and automation capabilities.
Amplify makes the most sense when your project looks like this:
You have a frontend app.
You need sign-up and sign-in.
You need file uploads.
You need a backend API.
You need a few serverless functions.
You want to deploy fast without turning your whole project into an infrastructure exercise.
That is exactly the kind of problem Amplify is built to simplify.
A good mental model is:
Amplify helps you build the app faster.
CDK helps you shape the cloud more precisely.
CDK becomes more valuable when your system is bigger than a typical app backend.
For example, if you need complex IAM rules, custom networking, multi-account deployments, advanced event-driven architectures, reusable internal infrastructure modules, or detailed control over how AWS services are configured, CDK is the better fit. AWS’s own documentation positions CDK around defining cloud resources with code, using constructs, stacks, and apps, rather than around the higher-level app workflows Amplify focuses on.
CDK also gives engineering teams more room to standardize infrastructure patterns.
That is useful for platform teams, DevOps-heavy teams, or backend teams building systems where infrastructure design itself is part of the product architecture. Again, that is an inference, but it follows naturally from CDK’s construct model, multi-language support, CloudFormation-based provisioning, and explicit bootstrapping/deployment workflow.
The biggest mistake is thinking Amplify is “simple AWS” and CDK is “real AWS.”
That is not the right way to look at it.
Amplify is opinionated on purpose. It gives you app-focused defaults and faster delivery. CDK gives you lower-level control and broader freedom. Neither is automatically better. They are solving different problems.
And here is the useful part: Amplify is not a dead end.
AWS explicitly documents that Amplify supports overriding generated resources via CDK, adding custom AWS resources through CDK or CloudFormation, importing existing resources, and even exporting Amplify infrastructure artifacts to CDK-based tooling. That is probably the most valuable thing to mention in this comparison, because it means Amplify can be a practical starting point rather than a trap.
Amplify is strong when your app matches its common patterns. But that also hints at its limitation.
The more your architecture moves away from standard app concerns and toward custom infrastructure design, the more likely you are to need escape hatches, overrides, imports, or CDK extensions. AWS’s own feature pages mention overrides, custom AWS resources, command hooks, imports, and export-to-CDK support, which is a good sign of flexibility, but also a sign that some teams will eventually outgrow the default path. That last part is an inference, but it is a practical one.
So Amplify is not weak. It is just optimized for a specific kind of speed.
CDK’s limitation is almost the opposite.
It gives you more power by giving you more responsibility. You need to think more about stack structure, deployment flow, permissions, environment setup, and bootstrap requirements. AWS also requires bootstrapping an environment for CDK deployments, which adds extra setup compared with a more app-focused experience.
So yes, CDK is flexible. But that flexibility can slow down product teams that really just want to ship features.
Choose AWS Amplify when you want to build and ship a web or mobile app quickly, especially when the app needs auth, storage, APIs, functions, hosting, and frontend integration out of the box.
Choose AWS CDK when you want deeper control over AWS infrastructure, broader architecture freedom, reusable cloud constructs, and explicit infrastructure design in code.
Choose Amplify first, then extend when needed if your immediate goal is product speed but you know the system may need custom AWS resources later. AWS supports that path.
AWS Amplify and AWS CDK are not really fighting for the same job.
Amplify is for teams trying to build an application faster.
CDK is for teams trying to control infrastructure more deeply.
If your real goal is to launch a product, onboard users, ship features, and avoid drowning in cloud setup too early, Amplify is often the more practical starting point.
If your real goal is to design AWS architecture with precision, CDK is the better tool.
The mistake is not choosing one over the other.
The mistake is choosing infrastructure complexity when what you really needed was application speed.
I can turn this into a cleaner Medium-ready version with a subtitle, 5-minute-read flow, and a stronger opening hook in your exact writing style.
A version of this article was first published on April 10, 2026 on Medium.
Why Permissions Feel Confusing in Amplify
What is AWS Amplify? Building a React app is the easy part. Then the “real app” requirements show up: Users need to sign up and log in You need an API You need a database You need file …
Why AWS Lambda Layers Become Essential as Your Serverless App Grows