Question

A developer is building a mobile app that requires users to sign up and sign in with an email and password. After authentication, the app must call a backend API and also let users upload files directly to an Amazon S3 bucket using temporary AWS credentials scoped to their identity. Which combination of Amazon Cognito features correctly satisfies both requirements?

Accepted Answer

Use a Cognito user pool to handle sign-up and sign-in, then pass the user pool tokens to a Cognito identity pool to exchange them for temporary AWS credentials for S3 access.

Answer

Use a Cognito identity pool for both user sign-up/sign-in and issuing temporary AWS credentials for S3 access.

Answer

Use a Cognito user pool for sign-up/sign-in and generate long-term IAM access keys per user for S3 access.

Answer

Use a Cognito user pool for sign-up/sign-in and have the app call S3 directly with the user pool ID token as the AWS credential.