To support file uploads in a new collaborative web portal, users must be able to sign up, sign in, and directly upload files to a private Amazon S3 bucket. The application needs to authenticate users and then obtain temporary AWS credentials for the uploads. Which TWO Amazon Cognito components should the developer implement to meet these requirements?
- A User Pool to manage user registration, sign-in, and provide a user directory.Answer
- An Identity Pool to exchange authentication tokens for temporary AWS credentials to access Amazon S3.Answer
- CAn IAM user with programmatic access keys stored directly in the web application's frontend code.
- DAn API Gateway Lambda Authorizer to generate AWS credentials for S3 uploads.
- EAn Identity Pool to store user profiles, passwords, and handle email verification workflows.
Answer
The developer should implement a Cognito User Pool to manage user registration and sign-in, and a Cognito Identity Pool to exchange the authentication tokens for temporary AWS credentials to access Amazon S3.
To support the user registration, authentication, and S3 file uploads, both User Pools and Identity Pools are needed. A Cognito User Pool manages the user directory, sign-up, and sign-in processes (authentication). Once authenticated, a Cognito Identity Pool exchanges the resulting token for temporary AWS credentials (authorization) that the application's frontend can use to upload files directly to Amazon S3.
Step-by-Step Solution
Key Concept
Distinction between Amazon Cognito User Pools (authentication and user directory) and Identity Pools (authorization and temporary AWS credentials for AWS resources).