I hated the idea of self hosting keycloak, learning how to terraform every single inch of it. But I worked at a startup that had a fucking weird investor who paid me, and would pay AWS, but wouldn't pay Okta (or any other 3rd party).
So given the choice between Cognito (easy right? It's a managed service!) and Keycloak (a large, complex security Swiss Army knife) should have been a no-brainer in favour of Cognito. But we absolutely hated it. I think it's one of the worst AWS services I've used.
Keycloak is only hard because security is hard. The terraform provider is amazing, worked remarkably well. We never had a single hitch, and I could spin up new tenants in seconds, or deploy Keycloak to other regions in a few minutes.
Personally, I just hate the idea of running that type of thing in production unless it's my full time job (and it wasn't) and I have other team members who also knowit backwards. But for a sufficiently well staffed org that feels like moving this expertise inhouse and dumping a paid auth service, Keycloak really is amazingly good.
Now that I've moved on to another job, my time spent in the belly of Keycloak wasn't wasted either. I can help our security team figure out auth issues blindfolded (ie: without access to their Okta admin interface, and in fact having never seen one)
So given the choice between Cognito (easy right? It's a managed service!) and Keycloak (a large, complex security Swiss Army knife) should have been a no-brainer in favour of Cognito. But we absolutely hated it. I think it's one of the worst AWS services I've used.
Keycloak is only hard because security is hard. The terraform provider is amazing, worked remarkably well. We never had a single hitch, and I could spin up new tenants in seconds, or deploy Keycloak to other regions in a few minutes.
Personally, I just hate the idea of running that type of thing in production unless it's my full time job (and it wasn't) and I have other team members who also knowit backwards. But for a sufficiently well staffed org that feels like moving this expertise inhouse and dumping a paid auth service, Keycloak really is amazingly good.
Now that I've moved on to another job, my time spent in the belly of Keycloak wasn't wasted either. I can help our security team figure out auth issues blindfolded (ie: without access to their Okta admin interface, and in fact having never seen one)