How AWS Cognito User Pool defends against bruteforce attacks

Question

I am going to use AWS Cognito User Pool product as user directory for application and have several questions:

1. Is Amazon throttle request to Cognito User Pool and

Answer 1

This contains the latest documentation on the lockout policies for Cognito.

https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow.html

We allow five failed sign-in attempts. After that we start temporary lockouts with exponentially increasing times starting at 1 second and doubling after each failed attempt up to about 15 minutes. Attempts during a temporary lockout period are ignored. After the temporary lockout period, if the next attempt fails, a new temporary lockout starts with twice the duration as the last. Waiting about 15 minutes without any attempts will also reset the temporary lockout. Please note that this behavior is subject to change.