Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is implementing authentication and authorization for a mobile retail shopping application. The application needs to allow users to sign up and sign in, make authorized calls to a backend order processing API hosted on Amazon API Gateway, and upload scan logs directly to a private Amazon S3 bucket. Which architecture meets these requirements with the least operational overhead?

  1. Configure a Cognito User Pool to handle user registration and login. Set up a Cognito Authorizer on Amazon API Gateway to validate the tokens generated by the User Pool. Configure a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS IAM credentials to authorize direct S3 uploads.Answer
  2. B
    Configure a Cognito Identity Pool to manage user registration and authentication. Set up a custom Lambda Authorizer on Amazon API Gateway to validate the session state, and use Cognito User Pool groups to authorize direct S3 uploads.
  3. C
    Configure a Cognito User Pool to handle user registration and login. Create a custom API Gateway Lambda Authorizer that parses the user identity from the User Pool, generates temporary IAM credentials, and returns them to the client to authorize S3 uploads and API calls.
  4. D
    Configure a Cognito User Pool to handle user registration. Write a custom IAM trust policy on the Amazon S3 bucket that allows direct write access based on the User Pool client ID, and use an API Gateway resource policy to authenticate API requests.

Answer

Configure a Cognito User Pool to handle user registration and login. Set up a Cognito Authorizer on Amazon API Gateway to validate the tokens generated by the User Pool. Configure a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS IAM credentials to authorize direct S3 uploads.
The correct solution leverages Cognito User Pools to authenticate users and generate JSON Web Tokens (JWTs). These tokens are verified directly by API Gateway using a built-in Cognito Authorizer, which requires no custom coding. To allow the mobile application to upload files directly to Amazon S3 without exposing static credentials or passing data through a backend, a Cognito Identity Pool is used to exchange the User Pool tokens for temporary, short-lived AWS IAM credentials.

Step-by-Step Solution

1
Select Amazon Cognito User Pools for authentication.
Enables user signup, signin, and directory management, producing JSON Web Tokens (JWTs) upon successful authentication.
User Pools are built specifically for identity management and authentication.
2
Configure API Gateway with a native Cognito Authorizer.
Enables API Gateway to validate User Pool tokens automatically without custom code or running a Lambda function.
Minimizes operational overhead and cost compared to custom Lambda authorizers.
3
Configure a Cognito Identity Pool (Federated Identities).
Allows authenticated User Pool users to exchange their tokens for temporary AWS credentials mapped to an IAM role with S3 write permissions.
Identity Pools are the standard AWS mechanism to authorize users for direct access to AWS resources like Amazon S3.

Key Concept

Cognito User Pools handle authentication (identity directory), while Cognito Identity Pools handle authorization (temporary AWS credentials for direct resource access). API Gateway Cognito Authorizers natively validate User Pool tokens.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic