Examkin

Question

Difficulty: MediumResolving IAM and Authorization Failures

A developer is building a mobile application that authenticates users through an Amazon Cognito User Pool. The application then exchanges the user's JSON Web Token (JWT) for temporary AWS credentials using an Amazon Cognito Identity Pool. These credentials are used to sign requests to an Amazon API Gateway REST API using AWS Signature Version 4 (SigV4). However, the API Gateway method is configured with a Cognito User Pool Authorizer, and all signed requests are failing with a 401 Unauthorized error. How should the developer resolve this authorization failure?

  1. Modify the API Gateway method's authorization type to AWS_IAM to allow authorization of requests signed with temporary IAM credentials.Answer
  2. B
    Replace the Cognito User Pool Authorizer with a custom Lambda authorizer to parse and validate the AWS Signature Version 4 signature manually.
  3. C
    Configure the client application to send the Cognito Identity Pool ID directly in the Authorization header as a bearer token instead of using Signature Version 4 signing.
  4. D
    Initialize the API Gateway client in the mobile application by hardcoding the IAM role's permanent access key and secret key.

Answer

Modify the API Gateway method's authorization type to AWS_IAM to allow authorization of requests signed with temporary IAM credentials.
Changing the API Gateway authorization type to AWS_IAM allows API Gateway to natively validate the Signature Version 4 (SigV4) headers. Since Cognito Identity Pools issue temporary IAM credentials associated with an IAM role (either authenticated or unauthenticated), the API Gateway method must be configured to use AWS_IAM authorization to allow access based on these IAM permissions.

Step-by-Step Solution

1
Analyze the request signing mechanism used by the client application.
The application uses temporary credentials from a Cognito Identity Pool to sign requests with AWS Signature Version 4 (SigV4).
Understanding how the request is signed helps determine which authorization type API Gateway expects.
2
Identify the authorization type currently configured on the API Gateway method.
The method is configured with a Cognito User Pool Authorizer.
A Cognito User Pool Authorizer expects a raw JWT (ID token or access token) from the User Pool in the headers, not a SigV4 signed request.
3
Update the API Gateway method authorization to match the client's credential type.
Change the authorization type to AWS_IAM.
AWS_IAM authorization allows API Gateway to natively process and authorize SigV4 signed requests using the IAM permissions of the assumed Cognito role.

Key Concept

Resolving Cognito User Pool vs. Identity Pool API Gateway Authorization failures by switching to AWS_IAM authorization for SigV4 signed requests.
Estimated Time:1m 30s
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic