Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A company is developing a mobile application that allows users to sign in using their enterprise SAML identity provider. After successful authentication, the mobile application needs to upload user-specific profile images directly to an Amazon S3 bucket, and make secure API calls to a backend REST API hosted on Amazon API Gateway. Which TWO configurations must the developer implement to meet these requirements?

  1. Configure an Amazon Cognito user pool with SAML federation for user authentication, and associate it with an Amazon Cognito identity pool to obtain temporary AWS credentials for Amazon S3 uploads.Answer
  2. Configure the API Gateway REST API to use a Cognito user pool authorizer to validate the ID or access tokens sent by the application.Answer
  3. C
    Configure an Amazon Cognito user pool to generate temporary AWS IAM credentials and attach an IAM policy to the user pool to permit direct S3 uploads.
  4. D
    Create a custom API Gateway Lambda authorizer to extract, decode, and manually validate the signature of the Cognito JSON Web Tokens (JWT) for standard API access.
  5. E
    Create an IAM role with write permissions to the Amazon S3 bucket, hardcode its access keys in the mobile application, and use API Gateway resource policies to control API access.

Answer

Configure an Amazon Cognito user pool with SAML federation for user authentication, and associate it with an Amazon Cognito identity pool to obtain temporary AWS credentials for Amazon S3 uploads; and configure the API Gateway REST API to use a Cognito user pool authorizer to validate the ID or access tokens sent by the application.
The correct configurations involve using an Amazon Cognito user pool federated with the SAML provider for authentication, and integrating it with an Amazon Cognito identity pool to supply temporary AWS credentials to the client for Amazon S3 uploads. Additionally, the developer should secure the API Gateway REST API using the built-in Cognito user pool authorizer to validate user tokens.

Step-by-Step Solution

1
Set up federated authentication with SAML by configuring an Amazon Cognito user pool to manage the user directory.
Users can log in via their enterprise identity provider and receive Cognito JSON Web Tokens (JWTs) representing their authenticated session.
This establishes the identity of the users using the existing SAML identity provider.
2
Configure an Amazon Cognito identity pool, link the user pool as an identity provider, and map authenticated users to an IAM role with S3 write access.
The client application can exchange the user pool tokens for temporary AWS IAM credentials with permissions restricted to the user's specific S3 folder.
This enables secure direct uploads from the mobile application to S3 without exposing permanent credentials or routing uploads through an intermediary backend.
3
Configure the API Gateway REST API with a Cognito User Pool Authorizer pointing to the created user pool.
API Gateway automatically intercepts incoming API requests, extracts the authorization header token, and validates it against the user pool before forwarding the request to downstream integrations.
This secures the REST API endpoints using the built-in, low-overhead Cognito authorization mechanism.

Key Concept

Combining Amazon Cognito User Pools for authentication and Identity Pools for AWS resource authorization, alongside built-in API Gateway Cognito Authorizers for securing REST endpoints.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic