A fitness SaaS with 200,000 mobile users needs social sign-in, MFA, and fine-grained access where premium subscribers can stream videos from S3 while free users cannot. The mobile app calls API Gateway and Lambda, and IoT scales must upload directly to S3 with temporary credentials. What auth design fits?
Select an answer to reveal the explanation.
Short Explanation
Need bouncers and wristbands at the same club? You check IDs at the door then hand scoped passes for the bar with Cognito pools working together. Sign-in stays separate from short-lived AWS access.
Full Explanation
The correct design works because it pairs managed authentication with scoped AWS authorization: Cognito user pools handles social sign-in, enforceable MFA, and group membership distinguishing premium from free users for Lambda authorizers and S3 policies, while identity pools exchanges that identity for short-lived credentials enabling direct mobile and scale access to S3 without long-term secrets. The user-pools-only design with Lambda authorizers covers login, MFA, and premium-aware APIs but fails on direct resource access because without identity pools there is no secure vending of temporary S3 credentials, forcing proxying video through Lambda and leaving scales unsolved. The identity-pools-only federated design vends temporary credentials for S3 and APIs but fails on directory enforcement because without user pools it cannot centrally require MFA or maintain scalable premium versus free policies. The design granting all users S3 streaming implements login, MFA, and temporary credentials but fails on fine-grained authorization because a single shared role violates least privilege and the premium-only constraint at scale. For exams, remember user pools authenticates identity and identity pools authorizes AWS access, so direct S3 plus login signals both. Practically, verify with policy simulation and CloudTrail that premium GetObject allows, free denies, and credentials expire in minutes.