Examkin

Question

Difficulty: HardAmazon Cognito Authentication and Authorization

A developer is building a mobile fitness application that integrates with an Amazon API Gateway REST API backed by AWS Lambda. The application requires users to sign in using their corporate Google Workspace accounts via OpenID Connect (OIDC). Once authenticated, the mobile client must send a secure token with every API request. The API Gateway must validate this token before forwarding the request to the Lambda function. Additionally, the Lambda function needs to access the user's Cognito group memberships to enforce fine-grained access control.

Which solution meets these requirements with the least operational overhead?

  1. A
    Configure an Amazon Cognito Identity Pool with Google as an identity provider. Secure the API Gateway REST API using a custom API Gateway Lambda authorizer that exchanges the Google token for temporary credentials, validates the session, and retrieves the group claims.
  2. Configure an Amazon Cognito User Pool with Google as an identity provider. Secure the API Gateway REST API using an API Gateway Cognito User Pool authorizer, and configure the API Gateway to use Lambda proxy integration. In the Lambda function, inspect the requestContext.authorizer.claims object to retrieve the user's groups.Answer
  3. C
    Configure an Amazon Cognito User Pool with Google as an identity provider. Implement a custom API Gateway Lambda authorizer that validates the JSON Web Token (JWT) sent by the client, calls the Cognito AdminGetUser API to retrieve user attributes, and passes the claims in the authorization context.
  4. D
    Configure an Amazon Cognito Identity Pool with Google as an identity provider. Set the API Gateway method authorization to AWS_IAM. Have the mobile application exchange the OIDC token for temporary AWS credentials via the Identity Pool, sign requests using Signature Version 4, and pass the group information in a custom request header.

Answer

Configure an Amazon Cognito User Pool with Google as an identity provider, secure the API Gateway using a built-in Cognito User Pool authorizer with Lambda proxy integration, and inspect the requestContext.authorizer.claims object in the Lambda function.
The correct solution utilizes an Amazon Cognito User Pool to manage authentication with the OIDC provider (Google) and secures the API Gateway REST API using the native Cognito User Pool authorizer. This authorizer validates incoming JSON Web Tokens (JWTs) automatically without writing custom code. Using a Lambda proxy integration ensures that all claims, including user groups, are parsed and passed in the requestContext.authorizer.claims object of the Lambda event payload, minimizing operational overhead.

Step-by-Step Solution

1
Determine the correct Cognito pool type for directory authentication and federation.
Cognito User Pool is selected because it acts as the user directory and supports OIDC/SAML federation, whereas Identity Pools are used for authorization and vending temporary AWS credentials.
The scenario requires users to sign in and authenticate via Google Workspace before accessing custom API endpoints.
2
Select the appropriate API Gateway authorization mechanism to validate the token with minimal overhead.
API Gateway Cognito User Pool Authorizer is selected instead of a custom Lambda Authorizer.
API Gateway native Cognito authorizers validate JWTs automatically without writing or maintaining custom code, reducing latency and operational overhead.
3
Configure the API Gateway integration and access token claims in the backend Lambda function.
Configure API Gateway with Lambda proxy integration. Retrieve the groups from the event's requestContext.authorizer.claims context object.
Lambda proxy integration automatically populates validated token claims in the event payload, allowing the backend function to perform fine-grained authorization using trusted group data.

Key Concept

Amazon Cognito User Pool Authorizer integration with Amazon API Gateway and Lambda proxy integration.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic