Examkin

Question

Difficulty: HardApplication Authentication and Authorization with Amazon Cognito

A developer is implementing authentication and authorization for a new Single Page Application (SPA) written in React. The SPA needs to securely invoke a REST API hosted on Amazon API Gateway and also upload user-generated profile images directly to a private Amazon S3 bucket. The solution must support user sign-up and sign-in, minimize custom backend code, and follow security best practices. Which architecture should the developer implement to meet these requirements?

  1. Implement an Amazon Cognito User Pool for user sign-up and sign-in using the Authorization Code Flow with PKCE. Secure the API Gateway REST API using a built-in Cognito User Pool authorizer. Set up an Amazon Cognito Identity Pool linked to the User Pool to exchange the ID token for temporary AWS credentials, and attach an IAM role to the Identity Pool that allows S3 uploads to a path restricted by the user's Cognito identity ID.Answer
  2. B
    Implement an Amazon Cognito Identity Pool to handle user sign-up, sign-in, and user directory management. Use the resulting temporary credentials to sign requests to the API Gateway REST API using AWS Signature Version 4, and use the same credentials to upload images to the S3 bucket.
  3. C
    Implement an Amazon Cognito User Pool for user sign-up and sign-in. Create a custom Lambda authorizer on API Gateway that validates the Cognito JSON Web Token (JWT) and calls the STS AssumeRole API to generate temporary credentials, which are returned to the SPA for direct S3 uploads.
  4. D
    Implement an Amazon Cognito User Pool for user sign-up and sign-in. Configure a Cognito User Pool authorizer on API Gateway. Create an IAM role with S3 write permissions, and modify the IAM role's trust policy to allow the Cognito User Pool service principal (cognito-idp.amazonaws.com) to directly assume the role on behalf of the web client.

Answer

Implement a Cognito User Pool for user sign-up and sign-in using the Authorization Code Flow with PKCE, secure the API Gateway REST API with a built-in Cognito User Pool authorizer, set up a Cognito Identity Pool to exchange tokens for temporary AWS credentials, and attach an IAM role to allow direct S3 uploads to a user-specific folder.
The correct architecture uses a Cognito User Pool for user authentication and directory management, which integrates natively with API Gateway using a built-in Cognito User Pool authorizer. To allow the frontend application to upload files directly to S3, a Cognito Identity Pool is required to exchange the authentication tokens for temporary AWS credentials with restricted permissions.

Step-by-Step Solution

1
Authenticate users using Amazon Cognito User Pools.
Users can register and log in, receiving Identity, Access, and Refresh tokens on the client SPA.
User Pools act as the user directory and handle authentication flows (specifically the Authorization Code Flow with PKCE for SPAs).
2
Configure the API Gateway REST API with a built-in Amazon Cognito User Pool authorizer.
Incoming API requests are automatically validated using the Cognito ID token, denying unauthorized access before reaching the backend Lambda functions.
The built-in Cognito authorizer requires no custom code, reducing maintenance overhead and latency.
3
Set up an Amazon Cognito Identity Pool linked to the User Pool.
The SPA exchanges the Cognito ID token for temporary, limited-privilege AWS credentials.
Identity Pools translate authentication tokens into AWS STS credentials for direct access to AWS resources like S3.
4
Attach an IAM role to the Identity Pool with a policy that limits S3 access.
Users can upload files directly to their own folders within the S3 bucket using a policy containing the '${cognito-identity.amazonaws.com:sub}' variable.
Using IAM policies with Cognito variables ensures secure, isolated user paths without needing an intermediary backend upload service.

Key Concept

Distinguishing and integrating Cognito User Pools (authentication) and Cognito Identity Pools (authorization/AWS credentials) for a Single Page Application.
Estimated Time:2m 30s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic