Question

A mobile photo-sharing app lets visitors browse public galleries stored in an Amazon S3 bucket before they sign up. Once users create an account, they can upload their own photos. The developer wants browsing visitors to read the public bucket without any login, while requiring a signed-in identity to upload. Which approach correctly grants the appropriate AWS permissions to each user type?

Accepted Answer

Configure an Amazon Cognito identity pool with both authenticated and unauthenticated roles, mapping guests to a read-only IAM role and signed-in users to a role allowing uploads.

Answer

Embed long-lived IAM access keys with read-only permissions in the app for guests, and generate new keys server-side after users sign in.

Answer

Create a Cognito user pool and grant unauthenticated visitors a JWT access token scoped to read-only S3 access.

Answer

Make the S3 bucket fully public for reads and use a bucket policy that requires SigV4-signed requests for uploads from any client.