Examkin

Question

Difficulty: EasyAmazon Cognito Authentication and Authorization

A developer is building a document search portal. The portal must support user registration and sign-in. Once authenticated, users must be able to call an Amazon API Gateway REST API to search for document metadata, and then download the corresponding PDF files directly from a private Amazon S3 bucket. Which TWO actions should the developer take to implement the authentication and authorization for this portal?

  1. Configure an Amazon Cognito User Pool to handle user registration and login, and use a Cognito Authorizer on the API Gateway REST API.Answer
  2. Configure an Amazon Cognito Identity Pool to exchange authentication tokens from the user pool for temporary AWS IAM credentials that allow read access to the Amazon S3 bucket.Answer
  3. C
    Configure an Amazon Cognito User Pool to generate temporary AWS IAM credentials directly for users to download files from the Amazon S3 bucket.
  4. D
    Implement a custom API Gateway Lambda Authorizer to validate Cognito User Pool tokens and generate temporary AWS IAM credentials for S3 access.
  5. E
    Configure an Amazon Cognito Identity Pool to manage the user registration, profile data, and login flow for the portal.

Answer

To secure the portal, the developer must configure an Amazon Cognito User Pool to handle user registration and authentication, utilizing a Cognito Authorizer on the API Gateway REST API. The developer must also configure an Amazon Cognito Identity Pool to exchange user tokens for temporary AWS IAM credentials allowing direct S3 access.
The correct strategy leverages the Amazon Cognito User Pool to manage authentication and user profiles, paired with a Cognito Authorizer on API Gateway to validate the resulting tokens. The Amazon Cognito Identity Pool is then utilized to exchange these tokens for temporary AWS credentials so the client can safely read objects from S3 without passing static credentials or routing file payloads through API Gateway.

Step-by-Step Solution

1
Configure user authentication and API protection.
Amazon Cognito User Pool is created, and the API Gateway API is configured with a Cognito Authorizer.
This establishes a user directory for registration/sign-in and allows API Gateway to validate user tokens natively.
2
Configure direct S3 access authorization.
Amazon Cognito Identity Pool is created, linked to the User Pool, and mapped to an IAM role with S3 read permissions.
This enables clients to exchange their User Pool tokens for temporary AWS IAM credentials to retrieve files directly from S3.

Key Concept

Distinction between Amazon Cognito User Pools for authentication and Amazon Cognito Identity Pools for authorization of AWS resource access.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic