You are building a mobile app that does not require user sign-in. What is the most efficient way to grant these anonymous app users limited access to AWS resources?

Amazon Cognito Identity Pools (federated identities) are designed for this exact scenario. They allow you to grant temporary, limited-privilege AWS credentials to unauthenticated (guest) users, enabling them to access AWS resources without needing a sign-in. You define an IAM role with the necessary restricted permissions, and Cognito handles the mapping for these guest users. Using an external identity provider is for authenticated users, which is not the requirement here. Creating an IAM user for each app access is inefficient, not scalable, and goes against security best practices for temporary access. Generating credentials with AWS KMS is not the primary mechanism for distributing temporary AWS access to application users; KMS is for managing encryption keys.