If you run internal apps on ECS, cognito effectively gives you beyondcorp for free. Being able to put cognito as a rule in your load balancer is choice. I wouldn't use it for anything else, though.