A SaaS startup runs a React web app and mobile clients that sign in with Google and corporate SAML IdP. The API on API Gateway and Lambda needs per-user JWT claims for authorization, plus temporary AWS credentials for direct S3 uploads. Which authentication design provides both user-directory federation and scoped AWS access?
Select an answer to reveal the explanation.
Short Explanation
You've got two jobs here: prove who users are, then hand them keys. User pools handle sign-in and JWTs while identity pools swap those tokens for temporary AWS credentials.
Full Explanation
Cognito user pools act as an OAuth 2.0 / OIDC authorization server that federates social and SAML identity providers, issues ID and access JWTs carrying groups and custom claims, and integrates natively with API Gateway authorizers and Lambda for fine-grained authorization, while Cognito identity pools exchange those authenticated tokens for temporary STS credentials mapped to IAM roles with S3-scoped policies for direct uploads, cleanly separating authentication from AWS authorization. Using identity pools alone fails because identity pools authorize AWS access but do not provide a user directory, hosted sign-in, or JWT issuance for API authorization. IAM Identity Center plus EKS Pod Identity targets workforce access and pod-to-AWS IAM role injection, not customer-facing social and SAML federation with mobile SDK credential vending. Lambda authorizers with IAM users misuses long-lived workforce credentials for external consumers, lacking federation, token lifecycle, and scalable credential vending. Exam caveat is to distinguish user pools for authentication and JWTs versus identity pools for STS credentials, and practical check is to verify API Gateway authorizer maps group claims and identity pool role mappings scope S3 prefixes per sub.