Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is designing a single-page web application where users sign in with their email address and password. After authentication, the application must be able to call a secure backend REST API hosted on Amazon API Gateway and download user-specific profile images directly from a private Amazon S3 bucket. Which two actions should the developer take to meet these requirements with the least operational overhead?

  1. Configure an Amazon Cognito User Pool to manage user authentication, and use the built-in Cognito User Pool Authorizer in API Gateway to validate the identity token (ID token) presented by the client application.Answer
  2. Configure an Amazon Cognito Identity Pool linked to the User Pool, and map an IAM role to authenticated users that provides read access to the specific Amazon S3 prefix.Answer
  3. C
    Embed IAM user access keys directly inside the client application code, and call the AWS STS AssumeRole API to retrieve credentials for S3 access.
  4. D
    Create a custom Lambda Authorizer in API Gateway that makes a direct query to the Cognito User Pool backend database to verify user credentials on every request.
  5. E
    Configure the S3 Bucket Policy to inspect the HTTP Authorization header and directly validate the JSON Web Tokens (JWTs) generated by the Cognito User Pool.

Answer

Configure an Amazon Cognito User Pool for user authentication alongside a built-in Cognito User Pool Authorizer in API Gateway, and configure an Amazon Cognito Identity Pool to delegate temporary AWS IAM credentials for S3 access.
The correct architecture uses a Cognito User Pool for managing user directories and generating JSON Web Tokens (JWTs) for API Gateway authorization via the built-in Cognito User Pool Authorizer. In addition, an Amazon Cognito Identity Pool maps the authenticated Cognito User Pool identities to temporary AWS IAM credentials, allowing the application to securely download private files directly from Amazon S3.

Step-by-Step Solution

1
Set up authentication directory
Amazon Cognito User Pool is configured to register and authenticate users via email and password.
This establishes the identity store and handles user sign-in flows.
2
Secure the API Gateway REST API
API Gateway is configured with a Cognito User Pool Authorizer linked to the User Pool.
This offloads token verification directly to API Gateway without requiring custom Lambda code.
3
Secure direct S3 access
An Amazon Cognito Identity Pool is created with the User Pool set as the authentication provider, and an authenticated IAM Role is associated with the required S3 read permissions.
This enables the client-side app to exchange the User Pool token for temporary AWS IAM credentials to interact directly with S3.

Key Concept

Distinction between Amazon Cognito User Pools (authentication and API Gateway authorization) and Identity Pools (exchange tokens for temporary AWS IAM credentials for direct AWS service access).
Estimated Time:2m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic