Question

A developer is building a document management web app that authenticates users with an Amazon Cognito user pool. Users belong to either an 'editors' or 'viewers' group in the user pool. After authentication, the app uses an identity pool to obtain temporary AWS credentials so users can access an S3 bucket directly. Editors must be able to upload objects, while viewers must only be able to read objects. What is the most effective way to enforce these different permission levels?

Accepted Answer

Assign a distinct IAM role to each Cognito user pool group and configure the identity pool to use role-based access control so the credentials returned match the user's group.

Answer

Store the user's group in a JWT custom claim and have the frontend JavaScript decide whether to call the upload or download S3 API.

Answer

Create a single IAM role for all authenticated users that grants both s3:GetObject and s3:PutObject, then filter access in the application code.

Answer

Attach an S3 bucket policy that grants s3:PutObject to the user pool ID and s3:GetObject to the identity pool ID.