A mobile app needs users to sign in with social providers and then read their own S3 objects directly. Which Cognito components are required, and what role does each play?
A.User pool for authentication; identity pool to exchange tokens for temporary AWS credentials scoped to S3
Correct. User pool = who you are; identity pool = what you can access.
B.Identity pool alone — it handles sign-in and S3 access
Identity pools don't manage users or passwords — they federate identities to AWS creds.
C.User pool alone — it issues S3 access credentials directly
User pools issue JWTs for your app, not AWS service credentials.
D.IAM users created per app user
Per-user IAM accounts don't scale and bypass federated sign-in entirely.
Why this answer
User pools handle authentication (sign-in, social IdPs, JWT issuance). Identity pools (federated identities) exchange authenticated identities for temporary IAM-scoped AWS credentials — letting the client call S3 directly with least-privilege access.
Correct answer: A · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security