Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is implementing a custom backend service hosted on Amazon ECS that processes requests from a mobile application. The mobile application authenticates users via an Amazon Cognito User Pool and includes the obtained JSON Web Token (JWT) in the Authorization header of each API request. To minimize latency, the developer wants the backend service to validate these tokens locally rather than making network calls to Amazon Cognito for every incoming request.

Which process should the developer implement to validate the incoming JWTs?

  1. Download and cache the JSON Web Key Set (JWKS) from the Cognito User Pool endpoint, match the token's key ID (kid) to a key in the JWKS, verify the cryptographic signature using the corresponding public key, and validate the token's expiration, audience, and issuer claims.Answer
  2. B
    Exchange the User Pool JWT for temporary AWS credentials by calling the Cognito Identity Pools API, and then check the token's validity using the AWS Security Token Service (STS).
  3. C
    Configure a custom API Gateway Lambda Authorizer to intercept each ECS request, forward the JWT to the Cognito User Pool GetUser endpoint, and let Cognito validate the token on behalf of the backend service.
  4. D
    Use an Amazon Cognito Identity Pool to obtain a symmetric AWS Key Management Service (AWS KMS) data key, decrypt the JWT payload on the backend service, and inspect the decrypted claims.

Answer

The correct process is to download and cache the JSON Web Key Set (JWKS) from the Cognito User Pool endpoint, locate the matching public key using the key ID (kid) header, verify the cryptographic signature, and validate the claims locally (expiration, audience, and issuer).
The correct approach is to retrieve the public JSON Web Key Set (JWKS) from the Cognito User Pool's public URI and cache it. When a request arrives, the backend service parses the JWT header to find the key ID (kid), verifies the cryptographic signature with the matching public key, and then verifies the claims locally (expiration, audience, and issuer). This avoids any network call during request processing.

Step-by-Step Solution

1
Retrieve the User Pool's JSON Web Key Set (JWKS) from the well-known public URI.
A collection of public keys that Cognito uses to sign JSON Web Tokens.
The backend service needs the public keys to cryptographically verify the token's signature.
2
Decode the token header to locate the Key ID (kid) and match it against the JWKS.
Identifies the correct public key to use for signature verification.
Cognito rotates signing keys, so the client must match the key ID from the token with the correct public key.
3
Verify the signature and validate claims (expiration, audience, issuer) locally.
Confirmed authenticity and validity of the user's session without making external network calls.
Verifying the claims ensures the token is not expired, was issued by the expected User Pool, and belongs to the correct App Client.

Key Concept

Local validation of Amazon Cognito User Pool JWTs
Estimated Time:1m 30s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic