The resources on the web I have seen so far suggest that the 'sub' claim in a JWT identifies the principal.
According to this question, at least for some identity provider implementations, one cannot transfer sub values from one identity provider to another should the need arise.
This would suggest that it is better for apps to create their own user_id value for each new user and have that included in the JWT as a custom attribute to be returned by the JWT as described here.
Up to now I have been happily relying on the sub claim but now I need to move to a different identity provider (actually a different user pool still within Cognito) and all my sub values are going to change, outside of my control.
Does anyone know if it is actually recommended practice to NOT allow the 'sub' to leak into application space and to use a custom attribute in the JWT to provide the application-controlled user_id?