A company has a web application that reads from and writes to an Amazon S3 bucket. The company needs to use AWS credentials to authenticate all S3 API calls to the S3 bucket. Which solution will…

Question

Options

• AIntegrate with Cognito identity pools and use GetId to obtain AWS credentials.
• BIntegrate with Cognito identity pools and use AssumeRoleWithWebIdentity to obtain AWS
• CIntegrate with Cognito user pools and use the ID token to obtain AWS credentials.
• DIntegrate with Cognito user pools and use the access token to obtain AWS credentials.

• A
  9% (2)
• B
  82% (18)
• C
  5% (1)
• D
  5% (1)

Explanation

Amazon Cognito identity pools are designed to provide temporary AWS credentials for applications by exchanging an authenticated identity token for AWS Security Token Service (STS) credentials. AWS Certified Security - Specialty guidance distinguishes between Cognito user pools (authentication) and identity pools (authorization to AWS resources). A user pool can authenticate a user and issue tokens, but an identity pool is required to obtain AWS credentials that can be used to sign AWS API requests, such as S3 API calls. The correct mechanism is for the application to use AssumeRoleWithWebIdentity through STS (which is the underlying federation method used by identity pools) to receive temporary credentials for an IAM role that grants S3 permissions. GetId alone does not provide credentials; it returns an identity identifier that is used as part of the credential exchange flow. Options C and D are incorrect because user pool tokens are not AWS credentials and cannot directly sign S3 requests. The solution therefore must use identity pools to map users to IAM roles and retrieve temporary credentials, satisfying the requirement for authenticated API calls using short-lived credentials.

No community discussion yet for this question.