A company has a web application that reads from and writes to an Amazon S3 bucket. The company needs to authenticate all S3 API calls with AWS credentials. Which solution will provide the…

The correct answer is B. Use Amazon Cognito identity pools and AssumeRoleWithWebIdentity. Amazon Cognito identity pools provide temporary AWS credentials by exchanging web identity tokens with AWS STS using AssumeRoleWithWebIdentity. According to AWS Certified Security - Specialty documentation, this is the correct mechanism for granting applications AWS User pools…

Submitted by yasin.bd· Mar 6, 2026Identity and Access Management (IAM)

Question

A company has a web application that reads from and writes to an Amazon S3 bucket. The company needs to authenticate all S3 API calls with AWS credentials. Which solution will provide the application with AWS credentials?

Options

AUse Amazon Cognito identity pools and the GetId API.
BUse Amazon Cognito identity pools and AssumeRoleWithWebIdentity.
CUse Amazon Cognito user pools with ID tokens.
DUse Amazon Cognito user pools with access tokens.

How the community answered

(23 responses)

A
9% (2)
B
74% (17)
C
4% (1)
D
13% (3)

Explanation

Amazon Cognito identity pools provide temporary AWS credentials by exchanging web identity tokens with AWS STS using AssumeRoleWithWebIdentity. According to AWS Certified Security - Specialty documentation, this is the correct mechanism for granting applications AWS User pools authenticate users but do not issue AWS credentials. Identity pools integrate with IAM roles and STS, enabling secure, temporary access to AWS services.

Topics

#Amazon Cognito identity pools#AssumeRoleWithWebIdentity#temporary credentials#S3 authentication

Community Discussion

No community discussion yet for this question.

Full SCS-C03 Practice