Examkin

Question

Difficulty: Very hardAmazon Cognito Authentication and Authorization

A developer is building a mobile application that allows external users to authenticate using an external OpenID Connect (OIDC) identity provider. Once authenticated, users must be able to upload log files directly to a private Amazon S3 bucket. Each user's uploads must be restricted to an S3 folder named after their unique OIDC user identifier (the `sub` claim). The application also needs to write metadata for each upload to an Amazon DynamoDB table, using the same OIDC `sub` value as the partition key. Which solution meets these requirements with the least development effort and adheres to the principle of least privilege?

  1. A
    Configure an Amazon Cognito User Pool with the OIDC provider. Configure an Amazon Cognito Identity Pool using the User Pool as an authentication provider. In the authenticated IAM role, define the S3 prefix and DynamoDB partition key using the policy variable `${cognito-identity.amazonaws.com:sub}`.
  2. B
    Create an Amazon API Gateway endpoint with a custom Lambda Authorizer. Have the Lambda Authorizer validate the OIDC token, retrieve the `sub` claim, and call `sts:AssumeRole` to generate temporary AWS credentials with an inline IAM policy scoped to the user's OIDC `sub` prefix. Pass these credentials back to the client to perform S3 and DynamoDB operations.
  3. Configure an Amazon Cognito User Pool with the OIDC provider as an identity provider, mapping the OIDC `sub` claim to a custom attribute. Configure an Amazon Cognito Identity Pool with the User Pool as an authentication provider, enabling 'Attributes for access control' to map the custom attribute to a principal tag. Reference the mapped tag using `${aws:PrincipalTag/...}` in the IAM policy for the authenticated role to authorize S3 and DynamoDB actions.Answer
  4. D
    Federate the OIDC provider directly with an Amazon Cognito Identity Pool. Associate an IAM role with the Identity Pool, and reference `${amazon.cognito.auth.externalIdp:sub}` in the IAM policy to restrict S3 bucket and DynamoDB access.

Answer

The correct solution is to configure the Amazon Cognito User Pool to map the OIDC `sub` claim to a custom attribute, map that attribute to a principal tag in the Identity Pool using 'Attributes for access control', and reference the tag via the policy variable in the IAM policy.
Mapping the OIDC `sub` claim to a Cognito User Pool custom attribute, exposing it as a Principal Tag via the Identity Pool's 'Attributes for access control', and utilizing the principal tag policy variable in the IAM policy is the most secure and operationally efficient way to implement attribute-based access control (ABAC) for federated users.

Step-by-Step Solution

1
Map the OIDC provider's unique `sub` claim to a custom attribute (e.g., `custom:oidc_sub`) in the Amazon Cognito User Pool during authentication setup.
The external provider's unique user identifier is captured and persisted in the Cognito user directory.
This makes the claim available for downstream mapping within AWS credentials session generation.
2
Enable 'Attributes for access control' in the Amazon Cognito Identity Pool and configure a mapping from the custom User Pool attribute `custom:oidc_sub` to a principal tag (e.g., `user_id`).
The identity provider claim is converted into a session tag (`aws:PrincipalTag/user_id`) attached to the temporary credentials issued by AWS STS.
This enables Attribute-Based Access Control (ABAC) dynamically on AWS services using IAM policy variables.
3
Create an IAM policy for the Cognito authenticated role that restricts S3 access to `arn:aws:s3:::my-bucket/aws:PrincipalTag/userid/∗‘andDynamoDBaccessbasedontheleadingkeymatching‘{aws:PrincipalTag/user_id}/*` and DynamoDB access based on the leading key matching `{aws:PrincipalTag/user_id}`.
Dynamic, fine-grained access control is enforced automatically for each unique user based on their federated OIDC session identifier.
This adheres to the principle of least privilege without creating separate IAM roles per user or writing token exchange logic.

Key Concept

Attribute-Based Access Control (ABAC) with Amazon Cognito Identity Pools and federated OIDC providers.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic