Question

A company is building a mobile application that lets users upload photos to a personal S3 prefix (e.g., uploads/<user-id>/). Users authenticate with their existing Google accounts. The security team requires that each authenticated user can only read and write objects under their own prefix, and that no long-term AWS credentials are embedded in the mobile app. Which approach meets these requirements?

Accepted Answer

Use an Amazon Cognito identity pool with web identity federation; users assume an IAM role via STS AssumeRoleWithWebIdentity, and the role's policy uses the ${cognito-identity.amazonaws.com:sub} variable in S3 resource ARNs to scope access per user.

Answer

Create one IAM user per app user and distribute each user's access keys through the mobile app after Google sign-in.

Answer

Embed a single shared IAM access key in the app and use an S3 bucket policy that allows all authenticated Google users to access the entire bucket.

Answer

Have the app call STS AssumeRole directly with a hard-coded IAM role ARN and static credentials, then restrict the prefix using a bucket ACL per user.