A healthcare company has 800 employees needing SSO to AWS accounts, plus a patient mobile app needing sign-up, MFA, and short-lived AWS API access for 200,000 external users without IAM users. Which identity design correctly assigns human, application, and system authentication for workforce and customer access?
Select an answer to reveal the explanation.
Short Explanation
You're separating two very different crowds correctly. Separation keeps employees in Identity Center and customers in Cognito so scaling, MFA, and AWS access stay clean.
Full Explanation
IAM Identity Center provides workforce identity with central SSO, SCIM, MFA, and permission sets to AWS accounts, which suits employees and operators, while Amazon Cognito User Pools handle customer directory functions like sign-up, sign-in, hosted UI, and MFA at internet scale and Identity Pools exchange authenticated tokens for short-lived STS credentials scoped to IAM roles for application access without provisioning IAM users. Reversing the services fails by concept because Identity Center is not designed as a massive external customer directory with app clients, and Cognito is not the workforce SSO permission-set manager for Organizations. Creating IAM users for customers and embedding keys fails because long-term credentials cannot scale securely, complicate rotation, and expose secrets in mobile binaries rather than issuing temporary scoped credentials. Relying on Identity Center for customers plus resource policies alone fails because resource policies do not provide customer registration, token issuance, or federation-to-role mapping needed for app authentication. For the exam, remember workforce equals Identity Center and customer app equals Cognito User plus Identity Pool for AWS access, and in practice verify IdP SAML or OIDC trust, token attribute mappings, and least-privilege role trust policies.