A mobile app needs user sign-up/sign-in with MFA, social identity providers (Google, Apple), and JWT tokens the backend can validate — without building an auth system. Which service provides this?
A.AWS IAM
IAM controls access to AWS resources, not application end-users.
B.Amazon Cognito user pools
Correct. Cognito user pools are the managed customer identity provider.
C.AWS IAM Identity Center
IAM Identity Center is workforce SSO for employees, not app customers.
D.AWS Secrets Manager
Secrets Manager stores secrets; it's not an identity provider.
Why this answer
Amazon Cognito user pools are a managed customer-identity directory with hosted sign-up/sign-in, MFA, social IdP federation, and JWT issuance. IAM manages AWS-resource access, not end-customer app authentication.
Correct answer: B · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM & Access Control practice session.
Practice IAM & Access Control