AWS Cognito: Do I need other AWS service to write a full functioning signup/signin system?

I am planning to write a mobile app with AWS handling the backend work. Like many common apps, mine will support user registration and login. All backend resources should be secure based on the user's role.

After reading AWS Cognito, it handles both Open authentication provider and Developer Authentication provider. This helps to support third party login. The capacity of syncing data is a big plus.

However, I have some questions about Cognito when I try further implementation.

1. What are the user credentials stored?


2. I need to add more user attributes (eg. email, profile image etc.) when a new user is created. Can Cognito handle this? Or do I need to use storage like S3 to store the entire user profile?


3. Does Cognito support email verification for user registration?


4. Does Cognito handle 'forgot password' feature?

All advices are welcomed.