A mobile app lets users browse public content without signing in, but if a user signs in through a supported social identity provider, the app should let that user upload files directly to an S3 bucket using temporary AWS credentials scoped to their identity, without the app's backend ever handling long-lived AWS credentials. Which service is designed for this?
- IAM Identity Center, which provides workforce single sign-on to multiple AWS accounts and business applications
- AWS STS AssumeRole called directly from the mobile app using a long-lived IAM user access key embedded in the app
- Amazon Cognito identity pools, which issue temporary AWS credentials scoped to an IAM role for both unauthenticated guest users and users authenticated through a supported identity provider
- AWS Directory Service, which provides a managed Microsoft Active Directory for domain-joined workloads
Why C? And why not the others?
Correct answer: C. Amazon Cognito identity pools, which issue temporary AWS credentials scoped to an IAM role for both unauthenticated guest users and users authenticated through a supported identity provider
Amazon Cognito identity pools are built exactly for this scenario: they issue temporary AWS credentials scoped to an IAM role for both unauthenticated guest identities and identities authenticated through a supported identity provider, letting an app's end users interact directly with AWS services such as S3 without the backend ever holding long-lived AWS credentials. The option describing workforce single sign-on is wrong because that service brokers employee access to AWS accounts and business applications, not temporary credentials for an app's individual end users. The option describing a long-lived IAM user access key embedded in the app is wrong because embedding such a key is the exact anti-pattern identity pools exist to avoid, since any user could extract and misuse a long-lived credential from the app. The option describing a managed Active Directory is wrong because that service supports domain-joined workloads and directory-based authentication scenarios, not issuing scoped temporary credentials to mobile app end users.
Source: Amazon Cognito documentation: Identity pools console overview (https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pools.html)