Can you export/migrate users out of AWS cognito, does it cause vendor lock-in?

Considering Amazon still haven't updated their answer, here's a workaround (to augment the accepted answer):

Try npmjs.com/package/cognito-backup-restore.

nb. I haven't tested this package.

Then:

1. Build your replacement auth system
2. At login, test authenticating with your new system
3. Try to authenticate with Cognito
4. If Cognito succeed, import user's details to your new system
5. Require a password update with your new system

source: forums.aws.amazon.com/thread.jspa?threadID=240242

At this point in time, Cognito does not allow a way to export users from a user pool. We have heard this request from other customers, though, and have prioritized it for future releases.

As far as passwords go, Cognito uses secure remote password protocol to do the actual authentications, so the metadata that could come out may not be particularly useful, if it was included at all.