Question

A company is building a mobile application that lets authenticated users upload photos directly to a specific prefix in an Amazon S3 bucket. The mobile devices must never store long-term AWS credentials, and each user should only be able to write to their own folder. Users authenticate through the company's existing OpenID Connect (OIDC) identity provider. What is the MOST secure way to grant the mobile app access to S3?

Accepted Answer

Configure the OIDC provider as an identity provider in IAM and use AWS STS with a web identity role that includes a policy scoped to the user's prefix using policy variables.

Answer

Create an IAM user for each mobile user, embed the access keys in the app, and attach a policy limiting them to their prefix.

Answer

Distribute a shared IAM access key with the app and use an S3 bucket policy to restrict uploads by source IP address.

Answer

Store a single long-term IAM role credential in AWS Secrets Manager and have the app retrieve it at startup.