A mobile app authenticates users via Cognito, then those users must call S3 and DynamoDB DIRECTLY with least-privilege permissions. Which Cognito piece issues the AWS credentials for this?
A.Cognito user pool — it issues JWTs and AWS credentials
User pools only authenticate — they don't mint AWS credentials.
B.Cognito identity pool — exchanges the user-pool token for temporary IAM-scoped AWS credentials
Correct. Identity pool = federation to IAM roles.
C.IAM users created per app user
Per-user IAM users don't scale and leak management burden.
D.API Gateway usage plans
Usage plans throttle API calls, not grant AWS access.
Why this answer
The canonical split: user pools authenticate (JWTs); identity pools authorize AWS access (exchange tokens for temporary IAM credentials). Direct service access from the client = identity pool with role mapping — the most-tested Cognito distinction.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security