A company is developing a mobile application that allows users to record their run times. The application needs to authenticate users and then grant them secure, direct access to read and write their run history in a specific Amazon DynamoDB table and upload route maps to an Amazon S3 bucket. Which combination of Amazon Cognito features should the developer use to meet these requirements?
- Use a Cognito User Pool to handle user registration and login, and exchange the resulting identity token with a Cognito Identity Pool to obtain temporary, scoped AWS credentials for accessing S3 and DynamoDB.Answer
- BUse a Cognito Identity Pool to handle user registration and login, and exchange the resulting authorization code with a Cognito User Pool to obtain temporary, scoped AWS credentials for accessing S3 and DynamoDB.
- CUse a Cognito User Pool to manage user directories, and configure an API Gateway custom Lambda authorizer that generates temporary AWS credentials by calling the AWS Security Token Service (STS) for each user.
- DUse a Cognito User Pool to handle authentication, and define IAM policies mapped directly to the Cognito User Pool App Client to grant users permissions to read/write DynamoDB and S3.
Answer
Use a Cognito User Pool to handle user registration and login, and exchange the resulting identity token with a Cognito Identity Pool to obtain temporary, scoped AWS credentials for accessing S3 and DynamoDB.
The correct option correctly details the standard workflow: using a Cognito User Pool for user authentication and directory management, and a Cognito Identity Pool to exchange the ID token for temporary, scoped AWS credentials. This allows the mobile app to communicate directly with Amazon DynamoDB and Amazon S3 using temporary IAM-based access.
Step-by-Step Solution
Key Concept
Separation of authentication and authorization using Cognito User Pools and Identity Pools
Estimated Time:1m 30s