Architects must not conflate citizen-facing sign-in with workforce AWS access for a municipal portal. Which identity pattern is correct?
Select an answer to reveal the explanation.
Short Explanation
Citizens get a library-card login (Cognito). Staff who open AWS doors get the employee badge system (IAM Identity Center). Mixing those—or handing citizens IAM users and keys—is how you blur customer identity with cloud admin access.
Full Explanation
Amazon Cognito user pools (and related customer-identity patterns) authenticate end users of applications, including citizens. AWS IAM Identity Center authenticates workforce users into AWS accounts and applications with permission sets. Using Identity Center as the public citizen IdP, creating IAM users per citizen, or embedding long-lived keys in mobile apps conflates customer identity with AWS control-plane access and fails least privilege. Keep citizen app identity on Cognito and workforce AWS access on Identity Center.