How Do You Securely Give a Private-Subnet App Cognito-Based S3 Access?

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources. Determine appropriate data security controls.

Short answer

AC Create a Cognito identity pool to issue temporary AWS credentials, and add an S3 gateway VPC endpoint so S3 traffic stays on the AWS network.

Question

A company hosts an application in a private subnet. The company has already integrated the application with Amazon Cognito. The company uses an Amazon Cognito user pool to authenticate users. The company needs to modify the application so the application can securely store user documents in an Amazon S3 bucket. Which combination of steps will securely integrate Amazon S3 with the application? (Choose two.)
  1. Create an Amazon Cognito identity pool to generate secure Amazon S3 access tokens for users when they successfully log in. Correct Answer
  2. Use the existing Amazon Cognito user pool to generate Amazon S3 access tokens for users when they successfully log in.
  3. Create an Amazon S3 VPC endpoint in the same VPC where the company hosts the application. Correct Answer
  4. Create a NAT gateway in the VPC where the company hosts the application. Assign a policy to the S3 bucket to deny any request that is not initiated from Amazon Cognito.
  5. Attach a policy to the S3 bucket that allows access only from the users' IP addresses.

Key Takeaways

This question tests the Cognito user pool versus identity pool distinction and private-subnet S3 connectivity; the trap is assuming the existing user pool can mint S3 access tokens on its own.

A private-subnet application already authenticates users with an Amazon Cognito user pool and now needs secure per-user access to Amazon S3. The correct combination is to add a Cognito identity pool for temporary AWS credentials and an S3 VPC endpoint so traffic never leaves the AWS network (A and C).

Common mistake: Choosing option B — reusing the existing Cognito user pool to generate S3 access tokens. User pools only authenticate users and issue OIDC/JWT tokens; they never vend AWS credentials, which is exactly what an identity pool does by exchanging those tokens for temporary, IAM-scoped credentials.

Expert Analysis

Why the Answer Is Correct

Option A is required because an Amazon Cognito identity pool is the component that exchanges the user pool's authentication tokens for temporary AWS credentials, which are then scoped by an IAM role to the specific S3 prefixes each user may read or write. Option C completes the secure integration: a gateway VPC endpoint for Amazon S3 keeps all traffic between the private subnet and the bucket on the AWS network, so documents are never exposed over the public internet and no NAT gateway is needed for S3. As LeonSauveterre put it, "Identity pools are for authorization" — that authorization layer plus private connectivity is precisely what the question asks for. The combination also aligns with the AWS guidance linked by bujuman to the identity pools and S3 interface/gateway endpoint documentation. Together A and C satisfy both halves of the requirement: authenticated users get least-privilege S3 credentials, and the private-subnet application reaches S3 securely.

Why the Other Options Are Wrong

Option B fails because a user pool issues ID, access, and refresh tokens for your application, not AWS credentials — it cannot generate Amazon S3 access tokens for users. Option D is wrong on two counts: a NAT gateway only provides outbound internet access rather than security, and an S3 bucket policy cannot meaningfully deny requests based on "initiated from Amazon Cognito." Option E is unworkable because user IP addresses are dynamic and untrusted, and an IP-allowlist policy would also break legitimate users on mobile or corporate networks while granting anyone sharing that address access to the documents. Only A and C address authentication-to-authorization and network path respectively.

Community Comment Notes

The community consensus in this thread is overwhelmingly AC, with the highest-voted comment by bujuman supplying the official Cognito identity pools page plus the S3 VPC endpoint documentation to justify both choices. LeonSauveterre adds the cleanest mental model, noting that "User pools are for authentication (who the user is). Identity pools are for authorization (what the user can do)." FlyingHawk similarly explains that identity pools produce temporary AWS credentials so only authenticated users can upload or retrieve documents. One learner dissented with "respuesta correcta: A - B," but B is the classic distractor: the existing user pool authenticates users but cannot issue AWS credentials, so that pairing would leave the application without any temporary S3 credentials.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Read the phrase "securely integrate Amazon S3" as a two-part signal: one option must establish per-user AWS credentials and one must establish a private network path. If you see an option that reuses a Cognito user pool for AWS credentials, eliminate it immediately — user pools authenticate, identity pools authorize.

Frequently Asked Questions

Why can't the existing Cognito user pool generate S3 access tokens?

A user pool only authenticates users and issues OIDC/JWT tokens for your app. Only an identity pool exchanges those tokens for temporary, IAM-scoped AWS credentials that can access S3.

Is the S3 VPC endpoint really needed in this private-subnet scenario?

Yes — a gateway endpoint lets instances in the private subnet reach S3 over the AWS network without a NAT gateway or internet exposure, which is part of the secure integration.

More SAA-C03 FAQ →

Community Votes

AC
100%

100% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. bujuman 👍 7
    securely integrate Amazon S3 with the application: https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pools.html https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3
  2. LeonSauveterre 👍 2
    A - Amazon Cognito identity pools provide temporary AWS credentials for authenticated users. B - User pools are for authentication (who the user is). Identity pools are for authorization (what the user can do). C - Traffic between your VPC and S3 stays within the AWS network, good. This also removes the need for a NAT Gateway for S3 access. D - Unnecessary and not secure. E - Users' IP addresses can change frequently (especially mobile users).
  3. FlyingHawk 👍 1
    An Amazon Cognito identity pool allows you to generate temporary AWS credentials (e.g., access tokens) for authenticated users. These credentials can be used to securely access AWS services like Amazon S3. By creating an identity pool, the application can generate secure Amazon S3 access tokens for users after they successfully log in, ensuring that only authenticated users can upload or access documents in the S3 bucket.
  4. viejito 👍 2
    respuesta correcta : A - B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide