A developer is writing a mobile application that allows users to view images from an S3 bucket. The users must be able to log in with their Amazon login, as well as supported social media accounts. Ho

Amazon Cognito identity pools support web identity federation, allowing users to sign in with Amazon login or social providers (Facebook, Google, Apple) and receive temporary AWS credentials scoped to an IAM role. This is the purpose-built AWS service for this use case and avoids embedding long-term credentials in mobile app code.

SAML-based identity federation is designed for enterprise SSO systems (e.g., Active Directory, Okta) and does not natively support consumer social media or Amazon login flows.

Embedding IAM access keys and secret keys directly in application code is a severe security anti-pattern and violates AWS security best practices.

AssumeRole requires the caller to already have valid AWS credentials; a mobile app user cannot call STS directly without first authenticating, creating a chicken-and-egg problem.