Question

A company is building a mobile application that must call an Amazon DynamoDB table on behalf of end users. Users authenticate through a public OpenID Connect (OIDC) identity provider (such as Google or a Cognito user pool acting as an OIDC IdP). The security team requires that the mobile app never embed long-term AWS credentials and that each user receive only temporary credentials scoped to their own data. Which approach meets these requirements with the least long-term credential exposure?

Accepted Answer

Configure an IAM role with a trust policy that trusts the OIDC provider, and have the app call AWS STS AssumeRoleWithWebIdentity using the OIDC token, restricting access with policy conditions on the token subject.

Answer

Create an IAM user for the application, distribute its access key in the app binary, and rotate the key every 90 days.

Answer

Have the app call AWS STS GetSessionToken with the OIDC token to obtain temporary credentials scoped to each user.

Answer

Create one IAM role per user and have the mobile app call AssumeRole directly using credentials embedded in the app.