A company is developing a client-side web application where users need to log in to their accounts and then upload profile images directly to a private Amazon S3 bucket. Which Amazon Cognito features should the developer implement to meet these requirements? (Select TWO.)
- Amazon Cognito User Pools to manage user registration, authentication, and directory services.Answer
- Amazon Cognito Identity Pools to authorize users and retrieve temporary AWS credentials for S3 bucket access.Answer
- CAmazon Cognito User Pools to directly issue temporary AWS credentials for the S3 bucket access.
- DAn Amazon API Gateway Lambda Authorizer to exchange user login tokens for S3 write permissions.
- EAWS IAM user access keys embedded in the application code to authenticate requests to the S3 bucket.
Answer
To authenticate users and obtain temporary AWS credentials for S3 uploads, the developer should use Amazon Cognito User Pools for user directory management, and Amazon Cognito Identity Pools to authorize and obtain temporary AWS credentials.
The correct solution involves using Amazon Cognito User Pools to authenticate the users and manage their directory, combined with Amazon Cognito Identity Pools to exchange the authentication tokens for temporary AWS credentials that allow the client application to upload files to the S3 bucket directly.
Step-by-Step Solution
Key Concept
The separation of concerns between Amazon Cognito User Pools (authentication) and Amazon Cognito Identity Pools (authorization and temporary AWS credentials).