A retailer has 2,000 corporate staff federated in Okta and 500,000 shoppers using a new mobile app with social logins. Staff need AWS console access by department, shoppers need scoped API access, and security forbids long-lived keys. Which identity design satisfies both human and customer authentication needs?
Select an answer to reveal the explanation.
Short Explanation
You separate employees from customers on purpose. Identity Center brokers workforce SSO while Cognito handles web-scale consumers. You'll avoid IAM-user sprawl and still keep short-lived tokens everywhere.
Full Explanation
IAM Identity Center is purpose-built for workforce authentication, federating an external IdP like Okta once and assigning permission sets by department to provide short-lived console and CLI access without IAM users, while Amazon Cognito user pools handle customer directory, social federation, and MFA at scale and Cognito identity pools vend scoped STS credentials for API calls. Creating IAM users for staff reintroduces long-lived credential management and fails to scale with departments, even if Cognito correctly serves shoppers. Putting both populations into Cognito user pools federated to Okta conflates workforce authorization with customer identity, losing centralized permission sets and account assignment. Using Identity Center for shoppers misapplies a workforce SSO service to internet-scale consumer auth, where it lacks social providers, self-signup, and app token flows. On the exam, map workforce to Identity Center and customers to Cognito and watch for long-lived keys as a red flag. In practice, check that Identity Center is enabled in your chosen home Region and that Cognito app clients use PKCE with short token lifetimes.