Cognito handles sign-up, sign-in, and access control for your web and mobile apps — so you don’t build authentication from scratch. The exam tests when to use it and its two building blocks.
User pools vs identity pools
User pools are the user directory — they handle sign-up, sign-in, MFA, and social/enterprise logins, returning tokens. Identity pools (federated identities) exchange those tokens for temporary AWS credentials so the app can reach AWS services. Question about authenticating app users? User pool. Granting them access to AWS resources? Identity pool.
Test yourself
A mobile app needs to let users sign in with Google or email and then upload files to S3 with temporary AWS credentials. Which service handles this?
- IAM users for every app user
- Amazon Cognito (user pool + identity pool)
- A shared access key in the app
- AWS Organizations
👉 Click to reveal the answer & explanation
Correct answer: B. Cognito user pools handle the sign-in (including social logins) and identity pools vend temporary AWS credentials for S3 access. Creating IAM users per app user (A) doesn’t scale; a shared key (C) is insecure; Organizations (D) manages accounts, not app users.
Related topics
AWS IAM · API Gateway · Amazon S3
Ready to pass the AWS Solutions Architect Associate (SAA-C03)?
Stop guessing whether you’re ready. Our full-length, exam-realistic practice exams put you through the exact question style you’ll face — with a detailed explanation behind every answer, so you learn why, not just what.
- ✓ 6 full-length practice exams
- ✓ A detailed explanation for every single question
- ✓ Realistic, scenario-based questions — not memory dumps
- ✓ Lifetime access, kept current for 2026
Get the SAA-C03 Practice Exams →or try 25 free questions first