SAA-C03 Practice Question 22: Cognito Identity Pool S3
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 3 · question 2 of 10
A photo-sharing mobile app already signs users in with an Amazon Cognito user pool. To cut backend costs, the app must now upload each user's photos directly to an S3 bucket instead of sending them through the company's API servers.
Each user may write only under their own prefix in the bucket, and no long-term AWS credentials may be shipped inside the app. What should the architect do?
Show answer and explanation
Answer:
User pools and identity pools do different jobs. A user pool authenticates users and issues tokens that tell your app who the user is. An identity pool exchanges those tokens for temporary AWS credentials tied to an IAM role, and those credentials are what you need to sign requests to AWS services such as Amazon S3. Configure the user pool as the identity pool's identity provider and attach a policy to the authenticated role. That policy uses the ${cognito-identity.amazonaws.com:sub} policy variable in the resource ARN, so each identity can read and write only its own prefix. The credentials expire on their own, and nothing long-lived is ever in the app.
Option A ships a long-term secret inside every copy of the app. Anyone who extracts it gets the same access as every other user, and a bucket policy cannot tell users apart when they all use one IAM user.
Option B confuses the two services. A user pool token is not an AWS credential, and Amazon S3 authorizes requests signed with AWS credentials. The token must first be exchanged through an identity pool.
Option C hands out long-term access keys, which the requirement forbids. It also creates one IAM user per app user, which doesn't scale and runs into IAM quotas.
References: Amazon Cognito identity pools; IAM roles