Secure way to download AWS S3 Contents from mobile app - mobile

Question

Problem Statement:
I want to download S3 contents through mobile app from multiple mobile devices.
Solution that I came across.
Solution 1
Create an IAM user in AWS. Create a policy to download S3 contents only for particular bucket and assign that policy to IAM user.
Whenever mobile application wants to download contents from S3, mobile application will call my server API which will return the credentials of IAM user.
Then mobile application will use these credentials to download the S3 contents.
Solution 2
Use AWS Cognito service.
However the problem with first approach is that I will have to manage credentials server side. Also someone can easily back track it and use those credentials outside application to download contents.
The second approach I am not aware of completely. However in the FAQ of AWS COGNITO service I did not found any solution to my requirement although it allows you to read, delete and put the content to any AWS service.
I need a suggestion regarding securely download S3 contents from mobile applications.

Answer 1

Amazon Cognito and the AWS Mobile SDK are designed especially for the use case of downloading content stored in S3 from a mobile app. You can use Cognito to provide temporary, limited-privilege AWS credentials to each user of your app. You can enable your users to start using your app as unauthenticated guests and/or authenticate with social logins or your own registration/login service.
To set up Cognito, use the Cognito console to create an Identity Pool, which is a store of user identity data specific to your AWS account. IAM roles define the permissions for your users to access AWS resources, like S3. Users of your application will assume the roles you create. You can specify different roles for authenticated and unauthenticated users. To learn more about IAM roles in Cognito, see IAM Roles.
When you visit the Cognito Console, a wizard will guide you through creating the Identity Pool and the necessary IAM roles. The integration between Cognito (which issues AWS Credentials to the mobile app user) and the other AWS Services is in the initialization of the SDK. Example code for initializing the SDK with Cognito on iOS, Android, Unity, and JavaScript are in the Getting Credentials topic of the Amazon Cognito Developer Guide].
Updates in October 2020:
AWS has shifted their "Mobile SDK" to AWS Amplify. Amplify still uses Cognito for authentication (login) and authorization (credentials/permissions) so the above is still accurate. You can get specific guidance on using Cognito with Amplify to set up Authentication here. Once you set up auth in Amplify, a specific example of using S3 is here.
Note that Cognito's docs focus on User Pools these days which allow you to implement your own full-fledged directory for storing and logging in users (for a cost). However, you don't have to use Cognito's user directory to store your users. Cognito Identity Pools (which still have no cost AFAICT) allow you to get AWS Credentials for users who are not logged into your app (so-called "Unauthenticated Identities") and/or allow users to login with other user directories (such as social logins or a user directory that you own and manage).
If you want ultimately flexibility, you can also use AWS STS to get credentials for accessing AWS Resources including S3. However, with STS's flexibility comes the need for more understanding of IAM/AWS and arguably more complex setup.
Please comment if there is anything I can do to make this more clear!