Examkin

Question

Difficulty: HardAPI Gateway Security and Authorization

A developer is designing a secure mobile banking application. The application uses Amazon API Gateway for its backend REST APIs and stores user documents in an Amazon S3 bucket. The security requirements are:

1. Access to the API Gateway APIs must be restricted to authenticated users. The API Gateway must natively validate the users' JSON Web Tokens (JWTs) without invoking a custom function.
2. Users must be able to upload documents directly to their own folder within the S3 bucket using temporary AWS credentials, ensuring least-privilege access.

Which two configurations should the developer implement to meet these requirements?

  1. A
    Configure an API Gateway Lambda Custom Authorizer to validate the JWT, then invoke AssumeRole against AWS STS to return temporary AWS credentials directly in the authorization context to S3.
  2. Configure a Cognito User Pool Authorizer on the API Gateway REST API to natively validate the JSON Web Tokens (JWTs) provided by the client application.Answer
  3. C
    Configure a Cognito Identity Pool as the primary API Gateway Authorizer, and use the Identity Pool client credentials to authenticate REST API calls via Lambda Proxy integration.
  4. Associate the Cognito User Pool with a Cognito Identity Pool to exchange authenticated tokens for temporary AWS IAM credentials, and assign an IAM policy with resource-level permissions for S3 folder access.Answer
  5. E
    Create a Cognito User Pool and write an IAM policy that allows the User Pool client credentials to authenticate S3 API calls using KMS envelope encryption.

Answer

To meet the requirements, the developer should configure a Cognito User Pool Authorizer on the API Gateway REST API to natively validate user tokens, and associate the Cognito User Pool with a Cognito Identity Pool to issue temporary AWS IAM credentials with policies that grant restricted folder access to the S3 bucket.
The correct configurations involve using a Cognito User Pool Authorizer to validate JWT tokens natively at the API Gateway level, and utilizing a Cognito Identity Pool in conjunction with the User Pool to provide authenticated users with temporary AWS IAM credentials. This enables secure, direct document uploads to specific S3 folders using IAM policies containing user identity variables.

Step-by-Step Solution

1
Configure the native authentication mechanism at API Gateway.
Create and deploy a Cognito User Pool Authorizer on the REST API methods. This offloads the token signature and expiration verification directly to API Gateway.
This meets the requirement of natively validating JWTs without writing and invoking custom Lambda functions.
2
Establish federated identity for AWS resource authorization.
Create an Amazon Cognito Identity Pool and configure the Cognito User Pool as an authentication provider.
This allows the client application to exchange the ID token received during user login for temporary AWS IAM credentials.
3
Enforce least-privilege direct access on the S3 bucket.
Attach an IAM policy to the Identity Pool's authenticated role that grants s3:PutObject permissions to paths matching the user's specific identity ID using the policy variable ${cognito-identity.amazonaws.com:sub}.
This allows authenticated mobile users to upload files directly to their personal folders on S3 without passing through backend servers, complying with the principle of least privilege.

Key Concept

Combining Cognito User Pools for native API Gateway authorization and Cognito Identity Pools for exchanging authentication tokens for temporary AWS credentials to access S3 directly under least privilege.
Estimated Time:2m 0s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic