Examkin

Question

Difficulty: HardAmazon Cognito Authentication and Authorization

A developer is building a serverless client-side web application. Users will log in using an Amazon Cognito User Pool. Once authenticated, the application must interact directly with AWS services from the browser to download user-specific documents from an Amazon S3 bucket, restricted to the path `documents/${cognito-identity.amazonaws.com:sub}/*`, and write application usage telemetry directly to an Amazon Kinesis Data Stream. The developer wants to implement this with the least operational overhead and without managing any backend API or compute resources. Which TWO actions should the developer take to configure this solution?

  1. Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and associate an authenticated IAM role that permits `s3:GetObject` on the prefix `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.Answer
  2. Configure the client application to exchange the Cognito User Pool ID token for temporary AWS credentials using the Cognito Identity Pool.Answer
  3. C
    Configure the client application to pass the Cognito User Pool Access token directly in the Authorization header of the requests to the Amazon S3 and Kinesis Data Streams endpoints.
  4. D
    Deploy an Amazon API Gateway REST API with a Cognito User Pool Authorizer, and route the client requests through the API to access S3 and Kinesis.
  5. E
    Generate long-term IAM User access keys with the required S3 and Kinesis permissions, and embed them in the client application code.

Answer

The developer should create an Amazon Cognito Identity Pool configured with the User Pool as an identity provider, assigning an authenticated IAM role that permits Kinesis and user-restricted S3 access. Additionally, the client application must exchange the Cognito User Pool ID token for temporary AWS credentials using the Identity Pool.
To interact directly with AWS services like Amazon S3 and Amazon Kinesis from a client-side application, temporary AWS credentials are required. By creating a Cognito Identity Pool and configuring the User Pool as an identity provider, you can exchange the User Pool ID token for temporary AWS IAM credentials. The authenticated IAM role associated with the Identity Pool can restrict S3 access to user-specific folders using the `${cognito-identity.amazonaws.com:sub}` policy variable and grant write permissions to the Kinesis stream, ensuring secure and direct access with minimal operational overhead.

Step-by-Step Solution

1
Configure the user directory and federation.
An Amazon Cognito User Pool is set up for authentication, and an Identity Pool is created with the User Pool configured as an identity provider.
This establishes a trust relationship where successful authentication in the User Pool allows the client to request credentials from the Identity Pool.
2
Define the permissions using an IAM policy on the Identity Pool's authenticated role.
The authenticated IAM role is assigned a policy allowing `s3:GetObject` on `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.
The `${cognito-identity.amazonaws.com:sub}` variable represents the user's Cognito Identity ID, ensuring users can only access their own documents, while Kinesis access allows direct telemetry ingestion.
3
Exchange tokens for credentials in the client application.
The client authenticates with the User Pool, obtains an ID token, and calls the Identity Pool to get temporary AWS credentials.
These credentials are used by the AWS SDK in the browser to sign requests directly to S3 and Kinesis using Signature Version 4.

Key Concept

Amazon Cognito Identity Pools enable client-side applications to obtain temporary, limited-privilege AWS credentials by federating identity providers like Cognito User Pools.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic