What should your server-side application do when a new user registers on the photo-sharing mobile application?

Answer is B
we can use either RDS or DynamoDB, however in our given answers, IAM role is mentioned only with RDS, so I would go with Answer B. Question was explicitly focused on security, so IAM with RDS is the best choice.

A. Incorrect, STS should only provide short-term credentials, not long-term credentials. If you want long-term credentials (which you probably would not for a mobile app scenario such as this!), you’d have to use IAM users.

B. This one could work on paper. There’s just one technicality that would cause me to question whether it would work in practice. The question is asking what procedure you should follow *every time a new user signs up*. Part of the procedure for B is, after you record the new user’s info in the DB, you then create an IAM role for that user. If you are truly following this procedure every time a new user signs up, this may not scale very well, because you are limited to 250 IAM roles per AWS account. While you can request an increase from AWS, the question says there could potentially be “millions of users” involved here. I am seriously doubting AWS would grant an exception for you to create millions of roles, one per mobile user, if their default limit is to cut you off at 250. They’re going to want to steer you toward a more scalable solution.

D and E. These are looking bad for scalability reasons, too. AWS is probably not going to let you create an individual IAM user for each of potentially millions of mobile users signing into your app. The default limit is 5000 IAM users per AWS account. They might grant an exception to raise that a little, but not for millions I am guessing. They’d want you to try a different approach with your app.

So with all other choices ruled out, that leaves C…

C. Manu and Srinivasu pointed out that C doesn’t mention anything about assuming a role, which you’d need to do, and they are both absolutely right. I am guessing that the author of this answer was being intentionally vague, and left out key details so as to disguise the answer so we would not immediately recognize this answer for what it is. If I’m reading it correctly, it’s hinting at a solution using Cognito, which is specifically made to handle authentication at web-scale, with millions of users. You use a web federation / OpenID partner to authenticate the user, and then Cognito presents the unique identifier for that user. You can create an S3 bucket with that unique identifier as a prefix in its name, then store the unique identifier, along with the new user’s submitted information, in DynamoDB. Cognito can call STS for temporary credentials for that user, using AssumeRoleWithWebIdentity, which will assume a pre-staged IAM role. You don’t need a unique IAM role per user (as is indicated in choice B), you can just stage a role in advance with a policy which will use that identity string as a variable granting them access to the S3 bucket containing that identity string in its name. (For more info: http://docs.aws.amazon.com/cognito/latest/developerguide/iam-roles.html under the “S3 Prefix” section).

So I’m thinking the answer could be C. I’m not happy that I have to assume a lot about what is happening, but which is not stated in that answer. An answer about a procedure should actually describe the steps that are happening in that procedure, especially if there are similar steps in procedures described in other answer choices, but omitted from this one. But all four other answers appear to be incorrect, and C would work, if you make those assumptions about what is not being stated. I am guessing the author intentionally avoided mentioning “Cognito” because then everyone would immediately jump to that answer as a potentially correct answer since this involves a mobile app.

All in all, I’m thinking these answer choices should be rewritten to be more clearly correct or incorrect, without having to make assumptions, especially B and C.