Two municipal clerks share the same Cognito group for the permit desk but must edit permits only for their own district. What should the application enforce beyond the shared group?
Select an answer to reveal the explanation.
Short Explanation
Same badge color does not mean every clerk owns every district map. Keep the Cognito group for coarse access, then check district claims or ownership in the app. Shared admin IAM users and unsigned query strings skip the real gate.
Full Explanation
Cognito groups provide coarse role membership but often cannot alone express per-resource constraints such as district ownership. Developers should implement application-level authorization—evaluating claims, attributes, or resource checks—before mutations. Sharing powerful IAM users or relying on unsigned client-supplied district IDs is insecure. Broad DynamoDB wildcards do not substitute for fine-grained authorization logic.