AWS Certified Developer – Associate (DVA-C02)SecurityMedium
A developer is building a mobile application that needs to authenticate users using social identity providers (e.g., Facebook, Google) and then grant them access to AWS resources. The application requires temporary, limited-privilege credentials for users to interact with services like Amazon S3 and DynamoDB directly from the mobile client. Which AWS service combination should the developer use to achieve this?
- AAWS Directory Service for Microsoft Active Directory and IAM roles.
- BCustom Lambda authorizer for API Gateway and direct IAM user credentials.
- CAWS IAM users and groups with federated access.
- DAmazon Cognito User Pools for authentication and Amazon Cognito Identity Pools for authorization.
Show answer & explanationAnswer & explanation
Correct answer: D. Amazon Cognito User Pools for authentication and Amazon Cognito Identity Pools for authorization.
Amazon Cognito User Pools handle user authentication, including integration with social identity providers. Amazon Cognito Identity Pools (Federated Identities) then provide temporary, limited-privilege AWS credentials to these authenticated users, allowing them to access AWS resources directly.
Why the other options are wrong
- A. AWS Directory Service is for enterprise directories, not typically for consumer mobile application authentication with social providers.
- B. Custom Lambda authorizers are for API Gateway authorization, and direct IAM user credentials are not secure for mobile apps.
- C. IAM users are for programmatic access or human users within an AWS account, not directly for mobile app users with social logins.
Cognito User Pools & Identity Pools (Federated Identities)
Amazon Cognito User Pools manage user directories for sign-up and sign-in. Amazon Cognito Identity Pools (Federated Identities) enable you to grant authenticated (or unauthenticated) users access to your AWS resources.
- User Pools handle authentication and social logins.
- Identity Pools provide temporary AWS credentials.
- Allows mobile/web apps to directly access AWS services securely.
Memory trick: User Pools Authenticate, Identity Pools Permit.