Examkin

Question

Difficulty: Very hardApplication Authentication and Authorization with Amazon Cognito

A developer is building a multi-tenant web application where users authenticate using an Amazon Cognito User Pool. The application must allow authenticated users to perform the following tasks:

* Call a private backend REST API deployed on Amazon API Gateway.
* Directly query tenant-specific items in an Amazon DynamoDB table using temporary AWS credentials.

The user's tenant ID is stored as a custom attribute (`custom:tenant_id`) in the Cognito User Pool. The developer wants to implement a secure, low-overhead solution that minimizes the number of IAM roles and avoids custom Lambda authorizers or validation code.

Which TWO configurations should the developer implement to meet these requirements?

  1. Configure an Amazon Cognito User Pool authorizer on the API Gateway REST API, and set the API methods to require this authorizer, validating the tokens passed in the request header.Answer
  2. Create an Amazon Cognito Identity Pool, link it to the User Pool, and enable the 'Attributes for access control' feature mapping the `custom:tenant_id` claim to a principal tag. Reference `${aws:PrincipalTag/tenant_id}` in the IAM policy condition for the authenticated role.Answer
  3. C
    Configure a custom Lambda authorizer on the API Gateway REST API to decode the Cognito User Pool token, call `sts:AssumeRole` to retrieve temporary credentials, and pass them back to the client.
  4. D
    Configure the Amazon Cognito User Pool to directly issue temporary AWS credentials to the client application, and use a policy condition matching `cognito-idp:tenant_id` to restrict DynamoDB queries.
  5. E
    Modify the trust policy of the authenticated IAM role to allow the API Gateway service principal (`apigateway.amazonaws.com`) to assume the role using the `sts:AssumeRole` action on behalf of the client.

Answer

Configure an Amazon Cognito User Pool authorizer on the API Gateway REST API to validate tokens, and create an Amazon Cognito Identity Pool linked to the User Pool that maps the custom tenant ID claim to a principal tag using attributes for access control.
To secure the REST API with minimum overhead, using a built-in Cognito User Pool authorizer is the best option because API Gateway handles the token validation natively. To query DynamoDB directly from the client with temporary AWS credentials, the application must use a Cognito Identity Pool linked to the User Pool. To enforce tenant isolation with low overhead (minimizing IAM roles), the developer should configure 'Attributes for access control' in the Identity Pool. This maps the custom user attribute (`custom:tenant_id`) to a principal tag, allowing the IAM policy for the authenticated role to dynamically restrict access using `${aws:PrincipalTag/tenant_id}`.

Step-by-Step Solution

1
Select the correct mechanism for securing the REST API using Amazon Cognito User Pools.
Identify that API Gateway features a native Cognito User Pool authorizer which can authenticate API requests without custom validation code.
This meets the requirement of securing the API with low operational overhead and no custom code.
2
Determine how to obtain temporary AWS credentials for DynamoDB queries.
Recognize that Cognito Identity Pools are required to exchange Cognito User Pool tokens for temporary AWS credentials.
Cognito User Pools cannot directly issue temporary AWS credentials.
3
Evaluate how to implement tenant-level isolation in the IAM role policy dynamically without role overhead.
Use the 'Attributes for access control' feature in Cognito Identity Pools to map the `custom:tenant_id` claim to a principal tag, and write a policy using `${aws:PrincipalTag/tenant_id}`.
This allows a single IAM role to enforce tenant isolation dynamically (ABAC), minimizing the number of IAM roles.
4
Verify trust policy configuration.
Ensure the trust policy allows the Cognito Identity service (`cognito-identity.amazonaws.com`) to assume the role via web identity.
This allows Cognito Identity Pools to hand out credentials for the role.

Key Concept

Integration of Amazon Cognito User Pools and Identity Pools for unified authentication (API Gateway) and fine-grained authorization (temporary credentials for DynamoDB via ABAC).
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic