How to implement user sign-in for a serverless application with minimal operational overhead?

A developer is designing a serverless application for a game in which users register and log in through a web browser. The application makes requests on behalf of users to a set of AWS Lambda functions that run behind an Amazon API Gateway HTTP API. The developer needs to implement a solution to register and log in users on the application's sign-in page. The solution must minimize operational overhead and must minimize ongoing management of user identities. Which solution will meet these requirements?

Create Amazon Cognito user pools for external social identity providers. Configure IAM roles for the identity pools. Source Reference Answer
Program the sign-in page to create users' IAM groups with the IAM roles attached to the groups.
Create an Amazon RDS for SQL Server DB instance to store the users and manage the permissions to the backend resources in AWS.
Configure the sign-in page to register and store the users and their passwords in an Amazon DynamoDB table with an attached IAM policy.

Community Votes

100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests the ability to choose a fully managed identity service over custom-built solutions; the trap is selecting options that require manual user storage or IAM misconfigurations for end-user identities.

Amazon Cognito user pools provide a fully managed, scalable identity solution for web and mobile applications, minimizing operational overhead by handling user registration, sign-in, and integration with social identity providers without requiring custom infrastructure.

Candidates often choose option D (DynamoDB) or C (RDS) because they mistakenly believe they must build a custom user directory, not realizing that Amazon Cognito is purpose-built for this exact use case with zero operational overhead.

Community Discussion (5 comments)

65703c1 👍 2 Selected: A

A is the correct answer.

KarBiswa 👍 3 Selected: A

Cognito is the option

ANDRES715 👍 3 Selected: A

Amazon Cognito es un servicio de AWS que permite agregar fácilmente la funcionalidad de registro e inicio de sesión a las aplicaciones. Puedes utilizar proveedores de identidades sociales externos, como Google, Facebook o Amazon, para permitir que los usuarios se registren e inicien sesión en tu aplicación. Al crear grupos de usuarios en Amazon Cognito y asignar roles de IAM a esos grupos, puedes gestionar de manera eficiente los permisos y accesos de los usuarios a los recursos backend en AWS. Esto te permite minimizar los gastos operativos y la gestión continua de las identidades de los usuarios.

monishvster 👍 3 Selected: A

Cognito is the answer

CrescentShared 👍 3 Selected: A

Anybody has an idea why it is C?

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Understanding the Requirements

The scenario describes a serverless application where users register and log in through a web browser. The key requirements are:

1. Register and log in users on a sign-in page 2. Minimize operational overhead 3. Minimize ongoing management of user identities

Why Option A is Correct

Amazon Cognito User Pools are purpose-built for exactly this use case. They provide:

Fully managed user directory — no servers, databases, or custom code needed for user storage
Built-in sign-up and sign-in functionality with customizable UI
Social identity provider federation (Google, Facebook, Apple, Amazon, etc.)
Seamless integration with API Gateway HTTP APIs using JWT tokens
Identity pools can then map authenticated Cognito users to IAM roles for fine-grained access to backend AWS resources (like Lambda functions)

This solution requires zero operational overhead for identity management, directly satisfying all stated requirements.

Why the Other Options Are Wrong

Option B (IAM Groups for end users): IAM is designed for AWS personnel and services, not for application end-users. You cannot programmatically create IAM groups per user at scale — this would be an operational nightmare and a security risk.

Option C (Amazon RDS for SQL Server): While you could store users in a relational database, this requires significant operational overhead — managing the database instance, patching, scaling, building authentication logic, hashing passwords, and securing credentials. This directly violates the "minimize operational overhead" requirement.

Option D (Amazon DynamoDB with IAM policy): Similar to option C, storing users and passwords in DynamoDB requires you to build and maintain the entire authentication flow yourself. Additionally, attaching an IAM policy directly to a DynamoDB table for user authentication is architecturally incorrect — IAM policies govern AWS resource access, not application-level user authentication.

Community Consensus

The community overwhelmingly agrees that Amazon Cognito (Option A) is the correct answer, with 100% of votes. Multiple commenters confirm that Cognito is the go-to AWS service for user registration and sign-in in serverless architectures.

Official Reference

Exam Strategy

When you see keywords like 'register and log in users,' 'minimize operational overhead,' and 'minimize ongoing management of user identities,' immediately think Amazon Cognito. AWS exam questions are designed to test whether you can distinguish between managed identity services and custom-built solutions — always choose the fully managed AWS-native option.

Related Analysis

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide