SAA-C03 practice question: Application user sign-in
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
Users must be able to sign up with an email address and password, or sign in with their Google account. After sign-in, the app uploads photos straight to Amazon S3, and each user may write only under their own prefix in the bucket. The company does not want to run its own sign-in servers or put long-term keys in the app.
Which solution meets these requirements with the LEAST custom code?
Choose one answer.
AA. Use a Cognito user pool with Google federation, and a Cognito identity pool whose role limits S3 writes to each user's identity ID prefix.
BB. Use IAM Identity Center with Google as the external identity provider, and give each user a permission set that allows S3 uploads.
CC. Use a Cognito user pool with Google federation, and have the app send the user pool's ID token straight to S3 with each upload.
DD. Have the app call AWS STS AssumeRoleWithWebIdentity with the Google ID token, using a role that limits S3 writes to a per-user prefix.
Show the answer and explanation
Answer: A
A. Right: Correct. The user pool handles email sign-up and Google sign-in. The identity pool swaps the user pool token for temporary AWS credentials, and the role's policy uses the ${cognito-identity.amazonaws.com:sub} variable so each user can write only under their own prefix. Learn more: Accessing AWS services using an identity pool after sign-in (opens in a new tab)
B. Wrong: IAM Identity Center is for a company's workforce signing in to AWS accounts and business applications, not for customers of a mobile app. It also has no self-service email sign-up for the public. Amazon Cognito is the customer identity service. Learn more: Choosing an AWS identity service (opens in a new tab)
C. Wrong: The user pool covers sign-up and sign-in, but S3 does not accept user pool tokens. Requests to S3 must be signed with AWS credentials. An identity pool is needed to exchange the token for temporary credentials. Learn more: What is Amazon Cognito? (opens in a new tab)
D. Wrong: This gives Google users temporary credentials, but it offers nothing for people who sign up with an email address and password. AWS recommends Amazon Cognito for mobile apps rather than calling this API directly. Learn more: AssumeRoleWithWebIdentity (opens in a new tab)
Explanation
Amazon Cognito user pools provide sign-up and sign-in for app users, including federation with Google. Cognito identity pools then give signed-in users temporary AWS credentials through an IAM role, and a policy variable on the identity ID keeps each user to their own S3 prefix. IAM Identity Center is for the workforce, and S3 cannot read user pool tokens directly.
The user pool handles Google sign-in, and the identity pool's role keeps each user to their own identity ID prefix.
Want more on Application user sign-in? The 5 full-length practice sets have 10 more Application user sign-in questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →