Cognito user pools vs identity pools: which do you need

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. A mobile app signs users in against an Amazon Cognito user pool and now needs those users to upload directly to Amazon S3 from the device, under permissions that differ by department. The team has the user pool's JSON web tokens and no AWS credentials. Which solution meets these requirements?

   Right. In the game that’s Renown for your Design Secure Architectures building.

   Not that one: B is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Call the S3 API with the user pool's access token as a bearer token, because the token already carries the user's OAuth scopes."From a user pool, you can issue authenticated JSON web tokens (JWTs) directly to an app, a web server, or an API" - an API that accepts JWTs, not the AWS APIs.The answerB.Exchange the user pool token at an identity pool for temporary AWS credentials, picking the IAM role from the user's claims.The two components do different jobs and this is the documented hand-off. "Your app user signs in through a user pool and receives OAuth 2.0 tokens. Your app exchanges a user pool token with an identity pool for temporary AWS credentials that you can use with AWS APIs and the AWS Command Line Interface. Your app assigns the credentials session to your user, and delivers authorized access to AWS services like Amazon S3 and Amazon DynamoDB." The per-department part is role-based access control: "when your user passes claims to your identity pool, Amazon Cognito chooses the IAM role that it requests", from a default role, from rules over the claims, or from the user's group membership in the user pool.Your answerC.Embed long-lived IAM user credentials in the app and scope them with a policy that reads the user's department from the token.Puts long-lived credentials on devices, which is the practice temporary credentials exist to replace.Your answerD.Add an Amazon API Gateway endpoint that performs the upload on the user's behalf, because a mobile device can never hold AWS credentials safely.Works, and moves every byte through a proxy the direct-upload requirement was trying to avoid.

   Written from docs.aws.amazon.com/cognito/latest/developerguide/what-is-amazon-cognito.html

2. A web application authenticates users against a Cognito user pool and calls only its own API, which runs behind Amazon API Gateway. No client code touches an AWS service directly. An architect proposes adding an identity pool so that every user has AWS credentials. The company needs each user's API calls authorized with the least operational overhead. Which solution meets these requirements?

   Right. In the game that’s Renown for your Design Secure Architectures building.

   Not that one: D is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Add the identity pool as proposed so that each user's calls are signed with AWS credentials.Issues AWS credentials to clients that never call an AWS service, widening what a stolen session reaches.Your answerB.Issue each user their own IAM role.A role per user does not scale and is what an identity pool exists to avoid.Your answerC.Replace the user pool with an identity pool, which can also authenticate users against a directory.An identity pool federates identities; it is not a user directory.The answerD.Authorize the API with the user pool's tokens and add no identity pool at all.AWS credentials are for calling AWS services, and this client calls none.

   Show the full explanation and doc quotes

   An identity pool exists to "sign API requests to AWS services like Amazon Simple Storage Service (Amazon S3) and Amazon DynamoDB", by exchanging a token for credentials. A user pool already produces what this application needs: it "is a user directory for web and mobile app authentication and authorization" and, to the app, "an OpenID Connect (OIDC) identity provider", whose JSON web tokens an API Gateway authorizer validates.

   Written from docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools.html

3. A company wants its staff to sign in to a new customer-facing app with the corporate SAML 2.0 identity provider, while external customers sign in with Google, and the app itself should see one consistent token format. Which approach will meet these requirements?

   Right. In the game that’s Renown for your Design Secure Architectures building.

   Not that one: C is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Federate the SAML provider into IAM and the social provider into a user pool.Leaves the app handling two token formats, which is the work the user pool's mapping removes.Your answerB.Use a Cognito identity pool as the service provider to both identity providers, which issues the app one set of OIDC tokens.An identity pool brokers AWS credentials rather than issuing application tokens, so the app would receive STS sessions instead.The answerC.Use a Cognito user pool as the service provider to both identity providers, which issues the app one set of OIDC tokens.Normalising identity providers into one token format is a user pool's job.Your answerD.Use AWS IAM Identity Center for both, because it federates workforce and customer identities into a single application token.IAM Identity Center is for workforce access to AWS accounts and applications, not a customer identity directory for an app.

   Show the full explanation and doc quotes

   AWS describes a user pool as "an intermediate service provider (SP) to third-party providers of workforce and customer identities": it can provide SSO "for your organization's workforce identities in SAML 2.0 and OIDC IdPs" and "for your organization's customer identities in the public OAuth 2.0 identity stores Amazon, Google, Apple and Facebook". The normalising is stated outright: "Amazon Cognito user pools accept tokens and assertions from third-party IdPs, and collect the user attributes into a JWT that it issues to your app. You can standardize your app on one set of JWTs while Amazon Cognito handles the interactions with IdPs, mapping their claims to a central token format."

   Written from docs.aws.amazon.com/cognito/latest/developerguide/what-is-amazon-cognito.html