Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A digital media startup is developing a mobile photo-sharing application that requires millions of end-users to upload images directly to a private Amazon S3 bucket. Which of the following approaches aligns with AWS Identity and Access Management (IAM) best practices for granting access to these users?

  1. Configure web identity federation using Amazon Cognito to provide users with temporary AWS security credentials.Answer
  2. B
    Generate a single set of long-term API access keys for an IAM user and embed them in the mobile application code.
  3. C
    Enable programmatic access keys on the AWS account root user and configure the application backend to share them with client devices.
  4. D
    Disable block public access on the S3 bucket and use a bucket policy to allow unrestricted uploads from any source.

Answer

Configure web identity federation using Amazon Cognito to provide users with temporary AWS security credentials.
The correct option is to configure web identity federation using Amazon Cognito. According to AWS IAM best practices, mobile application users should authenticate against an identity provider (such as Amazon Cognito, Google, or Apple) and exchange their identity token for temporary AWS security credentials. These temporary credentials have limited permissions and automatically expire, removing the need to distribute long-term AWS credentials.

Step-by-Step Solution

1
Analyze the access requirement for external mobile application users who do not have AWS accounts.
Identify that creating individual IAM users for millions of end-users is unmanageable and violates security practices.
IAM users are designed for internal employees, administrators, or application services, not for transient public application consumers.
2
Evaluate how to secure client-side resource uploads without storing permanent credentials in the client application.
Determine that temporary security credentials derived from an IAM role are required.
Temporary credentials expire automatically and do not require hardcoding secrets in the client application.
3
Select the appropriate service for external identity federation.
Choose Amazon Cognito web identity federation.
Amazon Cognito acts as an identity broker, allowing users to sign in via social or enterprise identity providers and exchange their login tokens for temporary AWS credentials.

Key Concept

Identity Federation and Temporary Security Credentials
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic