A developer is building a mobile application that requires users to authenticate before they can upload files directly to a private Amazon S3 bucket. The application must support user registration and sign-in, and provide temporary, limited-privilege AWS credentials to authenticated users for S3 uploads. Which combination of Amazon Cognito features should the developer use to meet these requirements with the least operational overhead?
- Authenticate users using a Cognito User Pool, and then exchange the user pool tokens for temporary credentials using a Cognito Identity Pool.Answer
- BAuthenticate users using a Cognito Identity Pool to generate JSON Web Tokens (JWTs), and use the Identity Pool's user directory to store user attributes.
- CAuthenticate users using a Cognito User Pool, and use a custom API Gateway Lambda authorizer to exchange User Pool tokens for temporary AWS credentials.
- DAuthenticate users using a Cognito User Pool, and configure the User Pool's trust policy to allow the mobile application to directly assume an IAM role.
Answer
Authenticate users using a Cognito User Pool, and then exchange the user pool tokens for temporary credentials using a Cognito Identity Pool.
The correct architecture uses a Cognito User Pool for user sign-in and directory management (authentication) and a Cognito Identity Pool to exchange those identity tokens for temporary, limited-privilege AWS credentials to access S3 (authorization). This is the standard, low-overhead pattern recommended by AWS.
Step-by-Step Solution
Key Concept
Separation of concerns between Cognito User Pools (authentication/directory) and Cognito Identity Pools (authorization/temporary credentials).