Examkin

Question

Difficulty: HardAmazon Cognito Authentication and Authorization

A developer is building a mobile application that allows users to upload high-resolution photos directly to a private Amazon S3 bucket. The application must authenticate users using an enterprise OpenID Connect (OIDC) identity provider. The developer wants to use Amazon Cognito to facilitate authorization, ensuring that users can only upload files to their own prefix (folder) within the S3 bucket using temporary, least-privilege credentials, without exposing any long-lived credentials. Which TWO configuration steps should the developer perform to meet these requirements?

  1. Configure an Amazon Cognito Identity Pool and add the OIDC identity provider as an authentication provider in the Identity Pool settings.Answer
  2. Create an IAM role for authenticated users with a trust policy for cognito-identity.amazonaws.com and a permissions policy that utilizes the cognito-identity.amazonaws.com:sub policy variable to grant s3:PutObject access to user-specific prefixes.Answer
  3. C
    Create an Amazon Cognito User Pool, register the enterprise OIDC provider as an identity provider, and configure the S3 bucket policy to authorize write operations using the Cognito User Pool's ID token.
  4. D
    Implement an API Gateway custom Lambda authorizer that validates the user's OIDC ID token and returns an IAM policy containing s3:PutObject permissions directly to the client application.
  5. E
    Create an Amazon Cognito User Pool client, map the OIDC provider attributes, and configure the mobile app to call the Cognito User Pool token endpoint to retrieve temporary AWS credentials.

Answer

To meet the requirements, the developer must configure an Amazon Cognito Identity Pool with the OIDC provider as an authentication provider, and associate an authenticated IAM role that utilizes the cognito-identity.amazonaws.com:sub policy variable to restrict S3 bucket upload access to the user's specific prefix.
To upload files directly to Amazon S3, a client requires temporary AWS credentials. Amazon Cognito Identity Pools (federated identities) enable this by allowing users to federate with external identity providers (such as an OIDC provider) and obtain temporary AWS credentials. Access to S3 can be scoped to user-specific folders by using the authenticated IAM role associated with the Identity Pool. By incorporating the cognito-identity.amazonaws.com:sub policy variable into the resource block of the IAM role's permission policy, the policy dynamically evaluates to the authenticated user's unique identity ID, thereby enforcing that users can only upload objects to their own folder prefix.

Step-by-Step Solution

1
Set up federation between the OIDC provider and AWS.
Configure an Amazon Cognito Identity Pool and register the OIDC provider within its settings.
This allows users authenticated via the enterprise OIDC provider to exchange their OIDC token for temporary AWS credentials using Cognito.
2
Define authorization permissions using an IAM role.
Create an authenticated IAM role with a trust relationship pointing to cognito-identity.amazonaws.com.
Cognito Identity Pools require an IAM role that defines the permissions granted to authenticated users. The trust policy permits Cognito to assume this role on behalf of the federated user.
3
Implement prefix-level isolation in the IAM permissions policy.
Reference the cognito-identity.amazonaws.com:sub policy variable in the S3 bucket resource ARN (e.g., arn:aws:s3:::my-bucket/${cognito-identity.amazonaws.com:sub}/*).
This dynamically limits each user's S3 put operations to their unique Cognito identity ID, ensuring proper isolation and data security.

Key Concept

Federation using Cognito Identity Pools and access control using Cognito policy variables
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic