Question

A mobile app authenticates users through an Amazon Cognito user pool. After sign-in, the app must let each authenticated user upload files directly to Amazon S3, but only to a folder prefix matching that user's identity. The developer wants users to receive temporary, scoped AWS credentials without embedding any long-term IAM access keys in the app. Which approach meets these requirements?

Accepted Answer

Exchange the user pool JWT ID token for AWS credentials using a Cognito identity pool with an authenticated IAM role that scopes S3 access using policy variables like ${cognito-identity.amazonaws.com:sub}.

Answer

Distribute an IAM user access key and secret key in the app configuration and restrict the IAM policy to the S3 bucket.

Answer

Call AWS STS GetSessionToken directly from the app using the user's Cognito username and password to obtain temporary credentials.

Answer

Store the credentials in AWS Secrets Manager and have the app fetch them at runtime using the user pool access token.