Citizens need email or social sign-in for a recreation registration app, while city staff will continue using corporate SSO for AWS consoles. Which service should authenticate the citizen end users of the application?
Select an answer to reveal the explanation.
Short Explanation
Citizens signing up for swim class are app users—not AWS console operators. Cognito user pools handle their email/social sign-in, while staff keep corporate SSO for AWS. Minting IAM users or root logins per household is the wrong door for a recreation app.
Full Explanation
Amazon Cognito user pools provide sign-up, sign-in, and token-based authentication for application end users, including social and email identity patterns. IAM users, root users, and IAM Identity Center permission sets target workforce or AWS management access—not citizen-facing recreation apps. Architects therefore separate Cognito for the workload’s consumer identity plane from corporate SSO for AWS administration.