These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-033
You are implementing sign-up and sign-in for the end users of a mobile app, together with federation with external identity providers such as Google. After authentication, you also want to use the same authentication result for access control on a REST API published through Amazon API Gateway. Which configuration is the most appropriate?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: D. Manage users in an Amazon Cognito user pool and validate the issued tokens with a Cognito authorizer on API Gateway
Explanation
An Amazon Cognito user pool is well suited to authenticating an app's end users. It provides sign-up, sign-in, MFA, and external identity provider federation as a managed service, and the ID tokens and access tokens it issues can be validated directly by a Cognito authorizer on API Gateway.
Per-choice explanations
A. Create an IAM user for each end user, embed access keys in the app, and call the API with SigV4 signatures
Incorrect. IAM is a mechanism for principals that operate AWS resources (internal people and applications); it is not designed to manage an app's end users as individual IAM users. Embedding long-term access keys in an app is also unsafe.
B. Manage end users in AWS IAM Identity Center and federate SAML assertions to the app
Incorrect. IAM Identity Center targets single sign-on for a workforce such as employees, and it is not intended for self-service sign-up by general consumers.
C. Store hashes of user names and passwords in AWS Secrets Manager and implement your own authentication logic in Lambda
Incorrect. Implementing authentication yourself means building password storage, MFA, token revocation, and external IdP federation from scratch. Secrets Manager is meant for storing credentials used by applications; it is not a user directory.
D. Manage users in an Amazon Cognito user pool and validate the issued tokens with a Cognito authorizer on API Gateway
Correct. The user pool acts as the user directory and token issuer while the Cognito authorizer on API Gateway handles token validation, so you do not have to implement authentication yourself.
Practical Use
Amazon Cognito consists of two features: user pools and identity pools (federated identities). A user pool is a user directory for your app that provides sign-up, sign-in, password policies, MFA, email/SMS verification, and federation with external IdPs such as Google and Apple as a managed service, issuing an OpenID Connect ID token, an access token, and a refresh token on successful authentication. An identity pool exchanges those tokens (or tokens from other IdPs) for temporary AWS credentials, and is used when the app needs to call S3 or DynamoDB directly. In design, you decide which to use based on "who you want to authenticate." General app users belong in a user pool, internal people and CI/CD that operate AWS resources belong in IAM, and employee single sign-on belongs in IAM Identity Center. When combined with API Gateway, configuring a Cognito authorizer on a REST API validates the token's signature, expiration, and aud/iss for you, removing the need to build your own Lambda authorizer. Use a Lambda authorizer alongside it only when you need finer control, such as branching on scopes or custom claims. On SAA-C03, requirements such as "user authentication for a mobile or web app," "social login," and "sign-up functionality" point to Amazon Cognito. Creating an IAM user per end user is a frequent distractor, but IAM users have a per-account limit and the feature was never intended for end-user management, so it is inappropriate as a design. The difference in role from IAM Identity Center (for the workforce) is also commonly asked.