A fully serverless auth layer for Docusaurus (or any static site) on S3 + CloudFront. Architecture, trade-offs, and the gotchas nobody warns you about.
TL;DR - Verified Google tokens server-side, created Cognito users via admin APIs with email_verified: true, generated deterministic passwords from user IDs + a server secret, and bypassed Cognito's hosted UI entirely. Works for signup and sign-in.…