City employees authenticate through a workforce identity provider, while residents use Amazon Cognito user pools for citizen apps. What identity approach should the team keep?
Select an answer to reveal the explanation.
Short Explanation
Staff badges and resident library cards are different doors on purpose. Federate employees through the workforce IdP; give residents Cognito user pools. Stuffing citizens into IAM users or going anonymous breaks the UX and the security model.
Full Explanation
Workforce employees and resident citizens are different identity populations and should remain on different patterns. Federate employees through the city’s workforce identity provider into IAM Identity Center or IAM federation for AWS console and internal tooling, and use Amazon Cognito user pools for resident-facing applications. Keeping those models separate avoids forcing citizens into IAM users and avoids treating employee SSO as a consumer app login.
Forcing residents to become IAM users in the city’s AWS account does not scale, pollutes the account’s principal namespace, and grants the wrong identity system for consumer apps. Replacing the workforce IdP with a shared Cognito password emailed to every department weakens employee identity assurance and breaks enterprise SSO controls. Using only anonymous access for both employees and residents abandons accountability for municipal systems that handle sensitive data.
Exam caveat: Cognito can federate enterprise IdPs for some application scenarios, but the stem’s separation—workforce IdP versus Cognito user pools for residents—is the architectural clarity the exam wants. Operational check: verify employee AWS access still flows through the workforce IdP path, citizen app login through Cognito user pools, and that no resident identities exist as IAM users created only to “log into the parks app.”