Question

A photo-sharing mobile app uses an Amazon Cognito identity pool to grant users temporary AWS credentials so they can upload images directly to an S3 bucket. Each user must be able to read and write ONLY objects under a prefix that matches their own Cognito identity ID (for example, private/${cognito-identity.amazonaws.com:sub}/). The developer wants to enforce this isolation without creating a separate IAM role per user. What is the MOST appropriate way to implement this?

Accepted Answer

Add IAM policy variables such as ${cognito-identity.amazonaws.com:sub} to the resource ARNs in the authenticated role's policy so each user is scoped to their own S3 prefix.

Answer

Generate a distinct pre-signed URL for every upload and download so the app never needs IAM permissions on S3.

Answer

Create a Cognito user pool group for each user and map each group to a dedicated IAM role that restricts access to that user's prefix.

Answer

Attach an S3 bucket policy that grants s3:GetObject and s3:PutObject to the identity pool's authenticated role for the entire bucket.