How to implement user sign-in for a serverless application with minimal operational overhead?

DVA-C02 By islever Editorial Last updated

Short answer

A Create Amazon Cognito user pools for external social identity providers. Configure IAM roles for the identity pools.

Question

A developer is designing a serverless application for a game in which users register and log in through a web browser. The application makes requests on behalf of users to a set of AWS Lambda functions that run behind an Amazon API Gateway HTTP API. The developer needs to implement a solution to register and log in users on the application's sign-in page. The solution must minimize operational overhead and must minimize ongoing management of user identities. Which solution will meet these requirements?
  1. Create Amazon Cognito user pools for external social identity providers. Configure IAM roles for the identity pools. Correct Answer
  2. Program the sign-in page to create users' IAM groups with the IAM roles attached to the groups.
  3. Create an Amazon RDS for SQL Server DB instance to store the users and manage the permissions to the backend resources in AWS.
  4. Configure the sign-in page to register and store the users and their passwords in an Amazon DynamoDB table with an attached IAM policy.

Key Takeaways

This question tests the ability to choose a fully managed identity service over custom-built solutions; the trap is selecting options that require manual user storage or IAM misconfigurations for end-user identities.

Amazon Cognito user pools provide a fully managed, scalable identity solution for web and mobile applications, minimizing operational overhead by handling user registration, sign-in, and integration with social identity providers without requiring custom infrastructure.

Common mistake: Candidates often choose option D (DynamoDB) or C (RDS) because they mistakenly believe they must build a custom user directory, not realizing that Amazon Cognito is purpose-built for this exact use case with zero operational overhead.

Expert Analysis

Understanding the Requirements

The scenario describes a serverless application where users register and log in through a web browser. The key requirements are:

1. Register and log in users on a sign-in page 2. Minimize operational overhead 3. Minimize ongoing management of user identities

Why Option A is Correct

Amazon Cognito User Pools are purpose-built for exactly this use case. They provide:

  • Fully managed user directory — no servers, databases, or custom code needed for user storage
  • Built-in sign-up and sign-in functionality with customizable UI
  • Social identity provider federation (Google, Facebook, Apple, Amazon, etc.)
  • Seamless integration with API Gateway HTTP APIs using JWT tokens
  • Identity pools can then map authenticated Cognito users to IAM roles for fine-grained access to backend AWS resources (like Lambda functions)
This solution requires zero operational overhead for identity management, directly satisfying all stated requirements.

Why the Other Options Are Wrong

  • Option B (IAM Groups for end users): IAM is designed for AWS personnel and services, not for application end-users. You cannot programmatically create IAM groups per user at scale — this would be an operational nightmare and a security risk.
  • Option C (Amazon RDS for SQL Server): While you could store users in a relational database, this requires significant operational overhead — managing the database instance, patching, scaling, building authentication logic, hashing passwords, and securing credentials. This directly violates the "minimize operational overhead" requirement.
  • Option D (Amazon DynamoDB with IAM policy): Similar to option C, storing users and passwords in DynamoDB requires you to build and maintain the entire authentication flow yourself. Additionally, attaching an IAM policy directly to a DynamoDB table for user authentication is architecturally incorrect — IAM policies govern AWS resource access, not application-level user authentication.

Community Consensus

The community overwhelmingly agrees that Amazon Cognito (Option A) is the correct answer, with 100% of votes. Multiple commenters confirm that Cognito is the go-to AWS service for user registration and sign-in in serverless architectures.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see keywords like 'register and log in users,' 'minimize operational overhead,' and 'minimize ongoing management of user identities,' immediately think Amazon Cognito. AWS exam questions are designed to test whether you can distinguish between managed identity services and custom-built solutions — always choose the fully managed AWS-native option.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. ANDRES715 👍 3 Answered A
    Amazon Cognito es un servicio de AWS que permite agregar fácilmente la funcionalidad de registro e inicio de sesión a las aplicaciones. Puedes utilizar proveedores de identidades sociales externos, como Google, Facebook o Amazon, para permitir que los usuarios se registren e inicien sesión en tu aplicación. Al crear grupos de usuarios en Amazon Cognito y asignar roles de IAM a esos grupos, puedes gestionar de manera eficiente los permisos y accesos de los usuarios a los recursos backend en AWS. Esto te permite minimizar los gastos operativos y la gestión continua de las identidades de los usuarios.
  2. CrescentShared 👍 3 Answered A
    Anybody has an idea why it is C?
  3. KarBiswa 👍 3 Answered A
    Cognito is the option
  4. monishvster 👍 3 Answered A
    Cognito is the answer
  5. 65703c1 👍 2 Answered A
    A is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Log Every Lambda Invocation to an SQS Queue?

S-grade

How to Test Updated Lambda Functions with a Subset of Users Using API Gateway?

S-grade

How to automate S3 object tagging after delayed third-party content audit?

S-grade

How to automatically rotate encryption keys for API keys in serverless apps with no development effort?

S-grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide