A parks mobile app needs citizen (external) sign-in, while city staff continue to use corporate SSO for the AWS Console. How should the architect separate these identity needs?
Select an answer to reveal the explanation.
Short Explanation
Citizens booking a picnic shelter are not city employees with AWS console badges. Cognito (or similar app identity) handles external sign-in; Identity Center or IAM federation handles staff SSO. Mixing both crowds into IAM users is the wrong crowd for the wrong door.
Full Explanation
Application end-user identity for citizens belongs in a customer identity service such as Amazon Cognito user pools, while workforce access to AWS accounts uses IAM Identity Center or federated IAM roles. IAM users are for human or workload access to AWS APIs and the console, not for scaling external mobile app customers. Embedding datastore credentials in the app or granting citizens AdministratorAccess via Identity Center violates least privilege and identity boundaries.