A fitness company's web and mobile apps let customers sign in with an email address through an Amazon Cognito user pool, and its backend APIs validate the user pool's tokens.
Marketing now wants customers to be able to sign in with their Google or Apple accounts as well. The backend must keep validating the same tokens, and customer profiles must stay in one place.
Which solution meets these requirements?
Choose one answer.
AA. Create an identity pool that trusts Google and Apple, and have the apps exchange those logins for AWS credentials.
BB. Create one extra user pool for each social provider and update the backend to trust the tokens from all three pools.
CC. Add Google and Apple as social identity providers in the existing user pool and send users through the pool's sign-in pages.
DD. Keep the user pool for email sign-in and add an API Gateway Lambda authorizer that validates Google and Apple tokens directly.
Show the answer and explanation
Answer: C
A. Wrong: An identity pool returns temporary AWS credentials, not user pool tokens, so the backend would have to change how it validates callers. It also leaves profiles outside the user pool. Federating through the user pool keeps the token format unchanged. Learn more: Amazon Cognito identity pools (opens in a new tab)
B. Wrong: Three pools means three issuers and three sets of signing keys for the backend to trust, which changes token validation. Profiles would also be split across pools. Social sign-in can be added to the existing pool instead.
C. Right: Correct. The user pool handles the exchange with the social provider and then issues its own tokens, so the backend sees the same kind of token however the user signed in. Federated users also get a profile in the same pool. Learn more: Social sign-in with user pools (opens in a new tab)
D. Wrong: This would work, but the backend then receives two kinds of identity and the team must write and maintain token validation for each provider. Profiles for social users would also sit outside the pool. Letting the user pool federate the providers avoids that code. Learn more: Lambda authorizers for REST APIs (opens in a new tab)
Explanation
A Cognito user pool can federate social identity providers and then issues its own standard tokens, so the backend does not change and profiles remain in one pool. An identity pool returns AWS credentials rather than user pool tokens. Extra pools or custom authorizers add issuers and code to maintain.
Want more on Amazon Cognito and federated access? The 5 full-length practice sets have 15 more Amazon Cognito and federated access questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →