Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is building a command-line interface (CLI) tool that internal engineers will use to upload software builds directly to a private Amazon S3 bucket. The engineers authenticate with the company's external OpenID Connect (OIDC) identity provider. The CLI tool needs to obtain temporary AWS credentials to write to the S3 bucket directly.

Which solution meets these requirements with the least operational overhead?

  1. Configure an Amazon Cognito Identity Pool, register the OIDC identity provider, and link it to an IAM role that grants write access to the S3 bucket.Answer
  2. B
    Configure an Amazon Cognito User Pool with OIDC federation, and use the user's ID token returned by the User Pool to authenticate directly to Amazon S3.
  3. C
    Configure an Amazon API Gateway REST API with a Cognito User Pool Authorizer, and route the upload traffic through API Gateway to write to the S3 bucket.
  4. D
    Configure an Amazon Cognito User Pool with OIDC federation, and write a custom AWS Lambda trigger to generate temporary AWS credentials using AWS Security Token Service (STS) when a user logs in.

Answer

Configure an Amazon Cognito Identity Pool, register the OIDC identity provider, and link it to an IAM role that grants write access to the S3 bucket.
The correct configuration uses an Amazon Cognito Identity Pool to federate with the OIDC identity provider. This pool directly exchanges OIDC tokens for temporary AWS IAM credentials, allowing the CLI tool to call the Amazon S3 PutObject API directly using an associated IAM role with minimum operational overhead and no custom code.

Step-by-Step Solution

1
Determine the authentication source and the authorization target.
The CLI authentication is managed by an external OpenID Connect (OIDC) identity provider, and the target is Amazon S3, which requires AWS IAM credentials.
Establishing the input and output requirements helps choose the right Cognito resource.
2
Differentiate between Cognito User Pools and Identity Pools for AWS resource authorization.
Cognito User Pools manage user directory and authentication tokens (JWTs), while Cognito Identity Pools exchange external identity tokens for temporary AWS credentials.
Since the CLI tool must authenticate directly to Amazon S3 using AWS credentials, an Identity Pool is the required service.
3
Select the configuration that minimizes custom integration and operational overhead.
Configuring a Cognito Identity Pool to map OIDC users to an IAM role is a native, serverless configuration requiring zero custom code.
This meets the objective of minimizing operational overhead and avoiding unnecessary intermediate proxies.

Key Concept

Amazon Cognito Identity Pools (Federated Identities) are used to exchange credentials from external identity providers (such as OIDC, SAML, or social IdPs) for temporary, limited-privilege AWS credentials to directly access AWS resources like Amazon S3.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic