Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is building a serverless mobile application for fitness tracking. The application needs to authenticate users using an external OpenID Connect (OIDC) identity provider. Once authenticated, the application must allow users to call an Amazon API Gateway REST API and upload workout logs directly to their own private folders in an Amazon S3 bucket. Which TWO configurations should the developer implement to meet these requirements?

  1. Set up an Amazon Cognito User Pool and federate it with the OIDC identity provider. Configure the API Gateway REST API to use a Cognito authorizer linked to the User Pool.Answer
  2. Set up an Amazon Cognito Identity Pool and configure the Cognito User Pool as an identity provider. Associate an authenticated IAM role with the Identity Pool that allows s3:PutObject for the uploads/\${cognito-identity.amazonaws.com:sub}/ prefix.Answer
  3. C
    Set up an Amazon Cognito User Pool and configure it to issue temporary AWS credentials to the mobile client using custom user attributes.
  4. D
    Configure an API Gateway Lambda Authorizer that parses the OIDC ID token, calls the Amazon Cognito Identity Pool to exchange it for IAM credentials, and returns an IAM policy to API Gateway.
  5. E
    Configure the Cognito User Pool with a client credentials grant type to directly generate temporary AWS IAM credentials for the client application.

Answer

To meet the requirements, the developer must configure an Amazon Cognito User Pool federated with the OIDC provider to authenticate users and secure the API Gateway REST API with a Cognito authorizer. Additionally, the developer must configure an Amazon Cognito Identity Pool with the User Pool as an identity provider, associating an IAM role that grants permissions to the user's S3 folder using the cognito-identity.amazonaws.com:sub variable.
The correct approach integrates both Cognito User Pools and Identity Pools. The User Pool handles OIDC authentication and issues JWT tokens, which the API Gateway Cognito Authorizer verifies. The Identity Pool then takes the User Pool ID token and exchanges it for temporary IAM credentials. The attached IAM policy uses the dynamic variable to restrict S3 uploads to the authenticated user's prefix.

Step-by-Step Solution

1
Federate the OIDC provider with a Cognito User Pool and configure the API Gateway Cognito Authorizer.
Users can log in using their OIDC identity, and the User Pool will issue JWT tokens that API Gateway validates natively.
This establishes user authentication and secures the API Gateway backend without custom authorization code.
2
Configure a Cognito Identity Pool using the User Pool as an authentication provider.
The client app can exchange the User Pool tokens for temporary AWS IAM credentials.
This bridges user authentication with AWS resource authorization.
3
Attach a fine-grained IAM policy to the authenticated role of the Cognito Identity Pool.
The IAM policy allows s3:PutObject only to the prefix uploads/\${cognito-identity.amazonaws.com:sub}/.
This restricts users so they can only write files to their own individual S3 folders using secure temporary credentials.

Key Concept

Integrating Amazon Cognito User Pools for user authentication/federation and Cognito Identity Pools for authorizing direct access to AWS resources like Amazon S3 using temporary AWS credentials.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic