SAA-C03 Q93 · Security

Question

A company hosts an application in a private subnet. The company has already integrated the application with Amazon Cognito. The company uses an Amazon Cognito user pool to authenticate users. The company needs to modify the application so the application can securely store user documents in an Amazon S3 bucket. Which combination of steps will securely integrate Amazon S3 with the application? (Choose two)

Accepted Answer

This question has two distinct requirements that must both be satisfied:

**Requirement 1: Securely grant users access to S3**
→ **Answer A: Amazon Cognito Identity Pool**
- A Cognito **user pool** handles authentication (who are you?), but it does NOT provide AWS credentials.
- A Cognito **identity pool** (federated identities) handles authorization (what can you access?). It exchanges user pool tokens for **temporary AWS credentials** (STS) with IAM roles.
- These temporary credentials allow the application to call S3 APIs (PutObject, GetObject) on behalf of authenticated users.
- Identity pools can assign different IAM roles to authenticated vs. unauthenticated users, enabling fine-grained access control (e.g., per-user S3 prefix access).

**Requirement 2: Application is in a private su

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips