what is a good auth strategy for team internal tools - for analytics stuff, the users are not coders. I'm not sure yet if I want to serve my tool as a website, or run as desktop app. If it is local I know sso is an option (I'm wondering if there is something easier for the user than sso - it can be complicated with broken credentials files or something). I think there is cognito but I am not sure if it is a fit for like other users on the same aws account.