Examkin

Question

Difficulty: Very hardAmazon Cognito Authentication and Authorization

An enterprise web application requires external partner users to authenticate using their corporate SAML Identity Provider (IdP). Once authenticated, users must be able to invoke private API endpoints hosted on Amazon API Gateway and upload large log files directly to a specific folder in an Amazon S3 bucket. The S3 folder path must be isolated per partner organization based on a SAML assertion attribute named `partnerId`.

Which combination of configuration steps should a developer implement to meet these requirements with the least operational overhead? (Select TWO.)

  1. Configure an Amazon Cognito User Pool to federate with the corporate SAML IdP, mapping the SAML partnerId assertion to a custom attribute. Set up a Cognito User Pool Authorizer on the API Gateway REST API to secure the private endpoints.Answer
  2. Establish an Amazon Cognito Identity Pool using the User Pool as an identity provider. Use the 'Attributes for access control' feature to map the custom partnerId attribute to a principal tag, and apply an IAM policy on the authenticated role that restricts S3 access using a ${aws:PrincipalTag/partnerId} policy variable.Answer
  3. C
    Configure an Amazon Cognito User Pool to federate with the corporate SAML IdP. Generate AWS temporary credentials by passing the User Pool access token directly to the S3 AssumeRoleWithWebIdentity API call, using the token's payload to construct the S3 folder prefix in the application code.
  4. D
    Create a Cognito Identity Pool that federates directly with the corporate SAML IdP. Configure a custom Lambda Authorizer on API Gateway that fetches the SAML assertion from the client header, validates the XML signature against the IdP's metadata endpoint, and generates an IAM policy for API Gateway.
  5. E
    Configure an Amazon Cognito User Pool to federate with the SAML IdP. Use a custom Lambda Authorizer on API Gateway to validate the ID token, and have the Lambda function exchange the token for temporary AWS credentials using the STS AssumeRole API before returning them to the client for S3 access.

Answer

Configure an Amazon Cognito User Pool federated with the SAML IdP using a Cognito User Pool Authorizer on API Gateway, and use an Amazon Cognito Identity Pool with Attributes for access control to map the custom partnerId attribute to a principal tag for dynamic S3 path restriction using the policy variable.
The correct solution involves combining Cognito User Pools and Cognito Identity Pools. The User Pool handles SAML federation and custom attribute mapping, allowing API Gateway to natively authorize requests using a Cognito User Pool Authorizer. The Identity Pool exchanges the User Pool tokens for temporary AWS credentials, utilizing the 'Attributes for access control' (ABAC) feature to securely map custom attributes to session principal tags. This lets a single IAM policy restrict S3 bucket paths dynamically using the policy variable, eliminating custom middleware.

Step-by-Step Solution

1
Set up authentication federation using an Amazon Cognito User Pool mapped to the SAML Identity Provider, mapping incoming assertions like partnerId to custom attributes.
Users can authenticate via their corporate credentials, receiving Cognito ID and access JWTs containing their partnerId custom attribute.
Provides a managed directory and token-based identity mechanism without managing credentials.
2
Configure the API Gateway endpoints with an Amazon Cognito User Pool Authorizer that validates the incoming ID/Access token directly.
Requests containing valid tokens are permitted to invoke the backend service, while invalid requests are blocked at the API Gateway layer without invoking backend compute.
Minimizes development effort and compute costs by avoiding custom Lambda validation logic.
3
Create an Amazon Cognito Identity Pool, configure the User Pool as the authentication provider, and enable 'Attributes for access control' mapping the custom partnerId attribute to the principal tag.
The identity pool returns temporary AWS credentials with the principal tag attached to the IAM session.
Allows AWS IAM to evaluate permissions dynamically based on user-specific attributes.
4
Write an IAM policy for the authenticated role referencing the dynamic principal tag variable inside the S3 resource ARN.
A single policy permits uploads only to the folder corresponding to the user's partner ID.
Enforces fine-grained authorization to S3 dynamically with zero-code IAM policy logic.

Key Concept

Federating identities with Cognito User Pools and Identity Pools, using User Pools for API Gateway authorization and Identity Pools with attribute-based access control (ABAC) for temporary AWS credentials.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic