A logistics firm runs a customer portal on AWS and on-premises barcode scanners that upload to S3. It needs temporary AWS credentials for scanners without stored keys plus fine-grained portal authorization by team and shipment. Which design should the architect adopt to enforce authorization for system and human access?
Select an answer to reveal the explanation.
Short Explanation
You've got two access problems, so you'll ditch stored keys and use IAM Roles Anywhere to hand your scanners short-lived credentials, like hotel key cards that expire at checkout. Then you can let Verified Permissions enforce your Cedar rules for portal access by team and shipment without messy role sprawl.
Full Explanation
The correct design succeeds because IAM Roles Anywhere lets on-premises scanners exchange X.509 certificates via a trust anchor for short-lived STS credentials to upload to S3 without stored keys, while Amazon Verified Permissions centralizes portal decisions in a Cedar policy store that evaluates team and shipment attributes for fine-grained authorization. The design combining Roles Anywhere with Cognito groups and IAM policies preserves secure machine credentials but fails granularity because group membership provides coarse RBAC that cannot efficiently model dynamic team-to-shipment relationships without policy sprawl and custom code. The design using Cognito identity pools for scanners with Verified Permissions for the portal preserves fine-grained portal control but fails workload identity because identity pools federate human and mobile users through an IdP flow, lacking certificate-based trust for unattended on-premises hosts. The design using the AWS IoT Core credential provider with Verified Permissions is valid for managed IoT fleets but fails fit because it requires Things, IoT certificates and IoT policies, adding unnecessary provisioning when scanners are general hosts suited to Roles Anywhere. For exams, separate machine credential issuance from human authentication and coarse roles from externalized fine-grained authorization instead of selecting on familiarity, and in practice verify trust-anchor configuration, certificate rotation, Cedar schema and policy simulation plus CloudTrail checks for S3 uploads and portal allow-deny behavior.