A company is creating a customer portal where registered users can log in and view their monthly account statements. These statements are stored in a private Amazon S3 bucket. The developer needs to implement a solution that authenticates users, manages their accounts, and provides them with temporary, limited-privilege AWS credentials to download their statements directly from S3.
Which Amazon Cognito configuration should the developer use to meet these requirements?
- AConfigure a Cognito Identity Pool to handle user registration and login, and write an IAM trust policy that allows the Identity Pool to directly generate permanent AWS credentials for S3 access.
- BConfigure a Cognito User Pool to handle user registration and login, and implement a custom Lambda Authorizer on the S3 bucket to validate user sessions and grant access.
- Configure a Cognito User Pool to handle user registration and login, and associate it with a Cognito Identity Pool to exchange the identity token for temporary AWS credentials that allow S3 access.Answer
- DConfigure a Cognito User Pool to handle user registration and login, and attach an IAM policy directly to the User Pool to grant S3 access to authenticated users.
Answer
Configure a Cognito User Pool to handle user registration and login, and associate it with a Cognito Identity Pool to exchange the identity token for temporary AWS credentials that allow S3 access.
The correct solution uses a Cognito User Pool to handle registration and authentication (acting as the user directory and producing identity tokens) and exchanges these tokens via a Cognito Identity Pool to obtain temporary AWS credentials with permissions to retrieve files from the Amazon S3 bucket.
Step-by-Step Solution
Key Concept
Cognito User Pools handle authentication (user directory), while Cognito Identity Pools handle authorization (temporary AWS credentials for AWS services).