FinchRide is launching a mobile app that must allow unauthenticated users to browse public content in Amazon S3 and authenticated users to save personal preferences in a DynamoDB table directly from the client. The security team requires least privilege per user without shipping long‑lived credentials in the app. Which approach should the Solutions Architect recommend?

This option correctly leverages Amazon Cognito's user pools for identity management (sign-up/sign-in) and identity pools for authorization. Identity pools provide temporary, limited-privilege AWS credentials for both authenticated and unauthenticated users, addressing the requirement for least privilege without shipping long-lived credentials. IAM roles and policy conditions (${cognito-identity.amazonaws.com:sub}) ensure fine-grained access control to S3 and DynamoDB based on the user's identity. The second option is incorrect because S3 and DynamoDB do not natively trust JWTs directly from a Cognito user pool for authorization; they require AWS credentials. The third option adds unnecessary complexity and cost with API Gateway and Lambda for simple direct access requirements and doesn't inherently solve the least privilege or credential management problem as effectively. The fourth option is less secure and more complex than using a Cognito identity pool, as AssumeRoleWithWebIdentity requires careful manual configuration and doesn't provide the unauthenticated access or integrated identity management of an identity pool.