Identify the federated identity flow

A mobile app uses Amazon Cognito so its users can upload files to Amazon S3 with their own scoped permissions. This relies on the federated identity flow: the user first authenticates against a Cognito User Pool, the User Pool returns tokens, the app hands the ID token to a Cognito Identity Pool, the Identity Pool exchanges it for temporary AWS credentials, and finally the app uses those credentials to call S3. Put the steps of this flow in the correct order.