You are building a mobile photo-storage app that must support tens of thousands of users. The backend uses API Gateway integrated with Lambda to process uploads, and DynamoDB stores photo metadata. Users must sign up, upload photos (300 KB–5 MB), and retrieve their previous uploads. Which architecture meets these requirements with the least operational overhead?

The correct option leverages Amazon Cognito User Pools for scalable user management and authentication, integrating seamlessly with API Gateway via a Cognito user pool authorizer. Storing photo files in Amazon S3 is ideal for large object storage, offering high availability, durability, and cost-effectiveness, while DynamoDB efficiently stores metadata and S3 object keys for fast lookups. This combination minimizes operational overhead by using managed services designed for scale. The other options are less suitable: Storing photos directly in DynamoDB is inefficient and costly for objects of this size (300 KB–5 MB), as DynamoDB is optimized for small, fast key-value lookups, not large binary data. Creating an IAM user for every application user is impractical and violates best practices for user management in a multi-tenant application, leading to significant operational overhead and security risks. Managing user accounts in a custom DynamoDB table with a Lambda authorizer increases operational complexity and requires custom development for features like password resets and multi-factor authentication, which Cognito provides out-of-the-box.