Question

A developer is building a mobile fitness app where users sign in with their existing Google accounts. After a user authenticates with Google, the app receives an OpenID Connect (OIDC) token and must obtain temporary AWS credentials so the app can upload workout files directly to an Amazon S3 bucket. The team does not want to manage a user directory themselves. Which approach lets the app exchange the Google token for temporary AWS credentials with the least custom code?

Accepted Answer

Call the AWS STS AssumeRoleWithWebIdentity API, passing the Google OIDC token, to receive temporary credentials scoped to an IAM role.

Answer

Call the AWS STS AssumeRole API from the mobile app using long-term IAM user access keys embedded in the app binary.

Answer

Store a shared IAM user's access keys in AWS Secrets Manager and have the app fetch them after Google sign-in.

Answer

Call the AWS STS GetSessionToken API with the Google OIDC token to obtain temporary credentials for S3.