A developer is designing a new web application where users must register and log in. Once authenticated, the application needs to retrieve temporary AWS credentials to allow the client-side code to download user-specific files directly from an Amazon S3 bucket.
Which two Amazon Cognito features should be configured to meet these requirements? (Select TWO.)
- An Amazon Cognito user pool to handle user registration, sign-in, and profile management.Answer
- An Amazon Cognito identity pool to exchange authentication tokens for temporary AWS credentials.Answer
- CAn Amazon API Gateway Lambda authorizer to generate and return temporary AWS Security Token Service (STS) credentials.
- DAn IAM trust policy applied directly to the user pool client to authorize read access to Amazon S3.
- EAn Amazon Cognito user pool client configured with an inline IAM policy to delegate access keys directly to the client browser.
Answer
Configure an Amazon Cognito user pool for user registration, authentication, and sign-in, and an Amazon Cognito identity pool to exchange authentication tokens for temporary AWS credentials.
To build this solution, the developer must configure an Amazon Cognito user pool for authentication (user registration and sign-in) and an Amazon Cognito identity pool for authorization (exchanging user pool tokens for temporary AWS credentials to access S3).
Step-by-Step Solution
Key Concept
Distinction between authentication (Cognito User Pools) and authorization/temporary credentials (Cognito Identity Pools)