A mobile app needs sign-up/sign-in for millions of end users, with social login and temporary AWS credentials for calling an API backend. What should you use?
A.IAM users created per app user
Millions of IAM users is an anti-pattern — IAM is for workforce/resource access, not app users.
B.Cognito user pools for authentication, plus identity pools for AWS access
Correct. User pool = auth; identity pool = AWS credential vending.
C.AWS SSO with external IdP
SSO (Identity Center) is for workforce access to AWS accounts and apps — not millions of app end users.
D.IAM roles shared by all app users
A shared role can't express per-user identity or track individual access.
Why this answer
User pools are the user directory (sign-up, sign-in, MFA, social IdPs); identity pools exchange the login for temporary AWS credentials. IAM users per end user don't scale and mix workforce auth with customer auth.
Correct answer: B · Last reviewed 2026-11-01
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM & Access Control practice session.
Practice IAM & Access Control