A museum's mobile app lets visitors browse exhibit photos stored under the public-gallery/ prefix of an Amazon S3 bucket before they register.
Visitors have not signed in, the app must not contain long-term AWS credentials, and access must be read-only and limited to that prefix.
Which solution meets these requirements?
Choose one answer.
AA. An IAM user with read access to the prefix, whose access key is built into the app so that every visitor can use it.
BB. A Cognito identity pool that allows guest access, mapped to an IAM role that permits s3:GetObject on the prefix only.
CC. A Cognito user pool with one shared guest account that every visitor uses to sign in to the app.
DD. A bucket policy that lets any principal call s3:GetObject on every object in the whole bucket.
Show the answer and explanation
Answer: B
A. Wrong: A key built into an app can be extracted and reused by anyone, and it does not expire. This breaks the rule against long-term credentials in the app. Temporary credentials issued to guests are the safer way to give anonymous users limited access. Learn more: Amazon Cognito identity pools (opens in a new tab)
B. Right: Correct. An identity pool can issue temporary AWS credentials to users who have not signed in, using a role that you scope down. Limiting the role to s3:GetObject on one prefix gives read-only access to just those photos. Learn more: IAM roles for identity pools (opens in a new tab)
C. Wrong: A user pool authenticates people and returns tokens, but it does not hand out AWS credentials by itself. A shared account also removes any way to tell visitors apart. A guest role in an identity pool is the feature built for unsigned-in users. Learn more: Amazon Cognito identity pools (opens in a new tab)
D. Wrong: Public read access needs no credentials, so it cannot meet the temporary credentials requirement. It is also wider than one prefix and exposes every object in the bucket. A bucket policy limited to the prefix would narrow it, but guests would still receive no credentials.
Explanation
Cognito identity pools can give temporary, scoped-down AWS credentials to guests as well as to signed-in users. The guest role is limited to s3:GetObject on one prefix, so nothing long-lived ships in the app and visitors cannot read other objects. User pools, embedded keys and public bucket policies each miss at least one requirement.
Want more on Amazon Cognito and federated access? The 5 full-length practice sets have 15 more Amazon Cognito and federated access questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →