DVA-C02 Question 126
Single answerA company is building a customer-facing web application that requires users to log in with their existing social media accounts (e.g., Google, Facebook). The company wants to avoid managing user credentials directly and ensure secure access to its backend AWS resources. Which AWS service and configuration approach should the team use to achieve this?
- A
Use Amazon Cognito to enable social identity providers and configure identity pools to grant temporary AWS credentials.
- B
Use AWS IAM to create user accounts for each customer and configure them with their social media credentials.
- C
Use Amazon S3 static website hosting and configure bucket policies to allow access only to users with social media accounts.
- D
Use AWS Lambda to authenticate users through social media APIs and generate AWS credentials programmatically.
Show answer and explanation
Correct answer: A
Explanation
Amazon Cognito is the ideal service for integrating social identity providers like Google and Facebook. It simplifies authentication by allowing users to log in with their social accounts and provides temporary AWS credentials via identity pools, ensuring secure access to backend AWS resources without the need to manage credentials directly.
- A. Correct.
This is the correct answer. Amazon Cognito allows you to integrate social identity providers like Google and Facebook, authenticate users, and provide them with temporary AWS credentials via identity pools to access AWS resources.
- B. Incorrect.
This is incorrect. AWS IAM is not designed to manage individual customer identities or integrate directly with social identity providers. IAM is primarily used for managing access for AWS accounts and services.
- C. Incorrect.
This is incorrect. While Amazon S3 can host static websites, it doesn't provide authentication mechanisms for users to log in with their social media accounts. Bucket policies cannot integrate with social identity providers.
- D. Incorrect.
This is incorrect. While AWS Lambda can interact with APIs, it is not designed to manage user authentication workflows or provide secure temporary credentials. Amazon Cognito should be used instead for this use case.