A Lambda in front of Cognito's token endpoint caches tokens in DynamoDB, reducing the number of requests to Cognito and saving money. By adding AWS WAF to block direct requests to Cognito, the solution ensures that all requests go through the Lambda, further reducing costs.