Examkin

Question

Difficulty: HardApplication Authentication and Authorization with Amazon Cognito

A developer is designing a new mobile application that allows users to sign up, sign in, and upload their personal fitness data files directly to a private Amazon S3 bucket. To ensure high security and scalability, the application must verify user identities, support social identity providers, and obtain temporary AWS credentials with fine-grained access policies restricted to each user's specific S3 folder (e.g., s3://fitness-app-data/user-id/). Which architecture represents the most secure and standard way to implement this authentication and authorization flow?

  1. Authenticate users through an Amazon Cognito User Pool. Exchange the resulting identity token with an Amazon Cognito Identity Pool to obtain temporary AWS credentials, which are mapped to an IAM role that grants access to the specific S3 folder.Answer
  2. B
    Authenticate users through an Amazon Cognito Identity Pool to manage the user directory and federation. Exchange the resulting session token with an Amazon Cognito User Pool to obtain temporary AWS credentials, which are mapped to an IAM role that grants access to the specific S3 folder.
  3. C
    Authenticate users through an Amazon Cognito User Pool. Call an Amazon API Gateway endpoint secured by a custom Lambda Authorizer that validates the identity token, calls AWS Security Token Service (STS) to generate temporary credentials, and returns them to the mobile application.
  4. D
    Authenticate users through an Amazon Cognito User Pool. Configure the application to use the User Pool client's client secret to directly assume an IAM role whose trust policy references the Cognito User Pool's Client ID.

Answer

Authenticate users through an Amazon Cognito User Pool. Exchange the resulting identity token with an Amazon Cognito Identity Pool to obtain temporary AWS credentials, which are mapped to an IAM role that grants access to the specific S3 folder.
The correct solution leverages Cognito User Pools to handle user sign-up, sign-in, and federation (authentication), yielding an ID token. This token is then provided to Cognito Identity Pools, which maps it to an IAM role to retrieve temporary, limited-privilege AWS credentials (authorization). This allows the mobile application to securely upload files directly to S3 using the temporary credentials, optimizing performance and security.

Step-by-Step Solution

1
Use Amazon Cognito User Pools to authenticate the user.
The user authenticates and the client application receives JSON Web Tokens (JWTs), specifically ID and Access tokens.
User Pools are designed to manage directories, handle user registration, and authenticate users.
2
Pass the received ID token to an Amazon Cognito Identity Pool.
The Identity Pool authenticates the token against the configured User Pool identity provider.
Identity Pools validate external identity provider tokens (like Cognito User Pools, Google, or Facebook) to establish identity.
3
Acquire temporary AWS credentials from the Identity Pool.
The Identity Pool assumes the associated IAM role and returns temporary AWS credentials (Access Key, Secret Key, and Session Token) to the mobile application.
This grants the client temporary, restricted access to AWS resources directly.
4
Use the temporary credentials to upload the fitness data files directly to the Amazon S3 bucket.
The client performs a secure, direct upload to the S3 folder mapping to the user's Cognito identity ID.
This minimizes backend application server overhead by offloading file uploads directly to S3.

Key Concept

Amazon Cognito User Pools vs. Identity Pools integration for AWS resource access.
Estimated Time:2m 0s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic