A regional hospital runs clinician portals on AWS with 400 staff using corporate Microsoft Entra ID, plus a patient mobile app needing social sign-up and MFA. Policy requires workforce SSO with short-lived AWS access and separate customer identities with adaptive auth. Which authentication solution meets both human identity needs with least custom code?
Select an answer to reveal the explanation.
Short Explanation
You nailed the split — workforce versus customers need different tools. IAM Identity Center handles staff SSO while Cognito shines for patient sign-up, like separate entrances for staff and visitors.
Full Explanation
IAM Identity Center connects to an external IdP such as Entra ID over SAML 2.0 with SCIM provisioning, centralized permission sets, and short-lived AWS console and CLI access ideal for workforce authentication, while Amazon Cognito user pools provide managed sign-up, social federation, and MFA plus identity pools for temporary AWS credentials ideal for customer authentication, so combining them satisfies both populations without custom identity code. Using IAM users for patients fails by concept because IAM is not designed for scale customer directory, password recovery, or social login and creates long-lived credential sprawl. Building everything in Cognito user pools with SAML for staff fails by concept because Cognito lacks centralized AWS account assignment, permission sets, and workforce lifecycle governance that Identity Center provides. Using Identity Center for patients fails by concept because it is workforce-only, requires provisioned workforce identities, and cannot provide self-service sign-up or social providers. Exam caveat: choose Identity Center for workforce SSO to AWS and Cognito for consumer apps. Practical check: verify external IdP SAML trust, SCIM sync, and Cognito MFA and identity pool role mappings.