Examkin

Question

Difficulty: Very hardAmazon Cognito Authentication and Authorization

A developer is designing a serverless web application where users authenticate via an Amazon Cognito User Pool. The application must meet the following requirements:

1. Access a REST API hosted on Amazon API Gateway, where endpoints must be secured so that only authenticated users can access them with minimal validation latency and zero custom validation code.
2. Upload files directly to an Amazon S3 bucket into a user-specific prefix (s3://app-uploads/\${user_id}/) without routing the files through a backend server.

Which TWO configurations should the developer implement to meet these requirements?

  1. Configure a Cognito User Pool Authorizer on the API Gateway REST API, and pass the Cognito ID token in the request Authorization header.Answer
  2. Create an Amazon Cognito Identity Pool with the User Pool configured as an identity provider, and assign an authenticated IAM role that grants access to the S3 bucket using the \${cognito-identity.amazonaws.com:sub} policy variable.Answer
  3. C
    Configure an API Gateway Lambda Authorizer that parses the client request and calls the Cognito Identity Provider GetUser API to validate the token on every method invocation.
  4. D
    Apply an S3 bucket policy that uses the Amazon Cognito User Pool ARN as the Principal to authorize upload actions based on the cognito:username claim.
  5. E
    Enable IAM authorization on the API Gateway REST API, and configure the client to pass the raw Cognito User Pool access token in the Authorization header.

Answer

Configure a Cognito User Pool Authorizer on the API Gateway REST API, and create a Cognito Identity Pool to obtain temporary AWS credentials mapped to an IAM policy that uses the client's identity ID prefix.
To secure the API Gateway REST API with zero custom code and low latency, a native Cognito User Pool Authorizer is configured to inspect the Authorization header and validate the ID token locally. To authorize direct uploads to S3, a Cognito Identity Pool is required to act as the credential broker. The client exchanges the User Pool token for temporary AWS credentials. By associating the authenticated IAM role of the Identity Pool with a policy that limits access using the identity ID context variable, users are securely restricted to their own folders.

Step-by-Step Solution

1
Select the appropriate authorization mechanism for API Gateway endpoints.
Using the native Cognito User Pool Authorizer validates tokens at the API Gateway edge, meeting the requirement of zero custom code and minimal latency.
This avoids the overhead of managing a custom Lambda authorizer or calling external Cognito APIs on every request.
2
Address the requirement for direct S3 bucket access from the client.
Since S3 does not validate Cognito User Pool JWT tokens directly, temporary AWS credentials must be obtained.
An AWS Identity Pool is required to exchange Cognito User Pool tokens for short-lived IAM credentials.
3
Implement resource isolation for S3 prefixes in the IAM policy.
Associate the authenticated role of the Identity Pool with an IAM policy that grants permission to the S3 bucket using the context variable for the Cognito identity ID.
This ensures users can only write to their own folder path using the unique identity pool subject identifier.

Key Concept

Integrating Amazon Cognito User Pools for API Gateway authentication and Cognito Identity Pools for S3 authorization.
Estimated Time:3m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic