A mobile game lets players sign in with Google or Facebook and then upload save files directly to a per-player S3 prefix. The app needs temporary AWS credentials for that upload. Which Cognito component provides them?
Show answer and explanation
Answer: A
A Cognito identity pool accepts identity tokens from social providers, or from a user pool, and exchanges them for temporary AWS credentials tied to an IAM role. The role's policy can use identity variables so that each player can write only under their own prefix. A user pool issues tokens for application sign-in but does not hand out AWS credentials by itself.
Why the other options are wrong
- B. A user pool manages sign-up and sign-in and issues JWTs for the app's own use. It does not vend temporary AWS credentials for direct S3 access by itself.
- C. Managed Microsoft AD is a directory service for enterprise and Windows workloads. It is not the mechanism for consumer social sign-in in a mobile app.
- D. IAM Identity Center is designed for workforce users such as employees signing in to accounts and applications. It does not serve end customers of a mobile game.