Question

A company is launching a mobile application that must allow users to sign up and sign in using their email address, and also offer the option to sign in with their existing Google or Facebook accounts. After authentication, the app calls a backend API fronted by Amazon API Gateway. The solutions architect must implement user authentication and secure the API with the least operational overhead. Which approach should the architect recommend?

Accepted Answer

Create an Amazon Cognito user pool with hosted UI, configure Google and Facebook as identity providers, and use a Cognito authorizer on API Gateway to validate the tokens.

Answer

Create an Amazon Cognito identity pool only, generate temporary IAM credentials for each user, and sign every API Gateway request with SigV4.

Answer

Store user credentials in Amazon RDS, build a custom authentication service on EC2 behind an Application Load Balancer, and issue custom JWTs validated by a Lambda authorizer.

Answer

Use AWS IAM Identity Center to create user accounts and federate Google and Facebook, then attach IAM policies granting each user access to the API Gateway endpoint.