After Cognito login, the parks mobile app must upload photos to each citizen’s own S3 prefix using temporary AWS credentials. Which Cognito capability vends those credentials?
Select an answer to reveal the explanation.
Short Explanation
User pools prove who signed in; identity pools hand out short-lived AWS keys. After login, exchange the token with an identity pool so the phone can PutObject to that citizen’s prefix—not a permanent key baked into the app.
Full Explanation
Cognito user pools handle sign-in and tokens; Cognito identity pools exchange authenticated identities for temporary AWS credentials used to call AWS APIs such as S3. User pool tokens are not IAM access keys; long-term keys in mobile apps are dangerous; Macie does not vend upload credentials.