A parks department app lets guests browse public park maps without signing in, but write APIs for reservation changes must require authenticated users. How should Cognito identity pools be used?
Select an answer to reveal the explanation.
Short Explanation
Guest browsing is a visitor badge for public maps—tight and read-mostly. Write APIs need a real authenticated identity, not the unauthenticated pool on steroids. Never hand guests broad AWS write.
Full Explanation
Cognito identity pools can issue limited credentials for unauthenticated (guest) access, which is appropriate for public read-only experiences such as park maps. Write and mutation APIs must require authenticated identities with least-privilege roles. Broad unauthenticated write permissions, open write APIs without identity, or reusing the guest role for paid reservations violate secure guest-identity patterns.