Examkin

Question

Difficulty: HardAmazon Cognito Authentication and Authorization

A developer is designing a secure integration for an enterprise application. While human users authenticate interactively via an Amazon Cognito User Pool, an external partner’s automated service must programmatically invoke a specific Amazon API Gateway REST API. The partner's service needs to perform machine-to-machine (M2M) communication without any user interaction. Which configuration meets these requirements with the least operational overhead?

  1. Configure a resource server in the Cognito User Pool and define a custom scope. Create a user pool client for the partner service, enable the Client Credentials grant flow, and configure the API Gateway method to use a Cognito authorizer that requires the custom scope.Answer
  2. B
    Create a custom API Gateway Lambda authorizer. Instruct the partner service to send its client credentials in the Authorization header. In the authorizer Lambda function, call the Cognito InitiateAuth API to validate the credentials on each request.
  3. C
    Set up an Amazon Cognito Identity Pool using developer-authenticated identities. Write a backend authentication service to verify the partner service, exchange credentials for temporary IAM credentials, and secure the API Gateway REST API using IAM authorization.
  4. D
    Configure a user pool client with the Authorization Code grant flow. Instruct the partner service to authenticate and obtain an ID token, then implement custom token validation logic in the backend Lambda function to verify the token signature on each request.

Answer

Configure a resource server in the Cognito User Pool and define a custom scope. Create a user pool client for the partner service, enable the Client Credentials grant flow, and configure the API Gateway method to use a Cognito authorizer that requires the custom scope.
Configuring a Cognito resource server and using the Client Credentials grant flow allows machine-to-machine clients to obtain OAuth 2.0 access tokens. API Gateway Cognito authorizers can natively validate these access tokens and restrict access based on the configured custom scopes. This requires no custom validation code or external identity pools.

Step-by-Step Solution

1
Analyze the client interaction requirements.
The requirement calls for machine-to-machine (M2M) communication without user interaction.
This rules out interactive authorization flows like Authorization Code or Implicit, pointing towards the OAuth 2.0 Client Credentials grant flow.
2
Select the appropriate Amazon Cognito feature set.
Amazon Cognito User Pools support OAuth 2.0 resource servers, custom scopes, and client clients with the Client Credentials grant.
Using a User Pool is more lightweight than building a custom credential exchange service with Cognito Identity Pools.
3
Determine the API Gateway integration strategy.
API Gateway's built-in Cognito authorizer can validate access tokens containing custom scopes natively.
Using a native authorizer avoids writing custom Lambda code to verify JWT signatures, reducing operational overhead and request latency.

Key Concept

Amazon Cognito User Pool Resource Servers and Client Credentials Flow
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic