Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A developer is designing a cross-platform client application that requires user sign-up, sign-in, and group-based access control. The backend services are hosted on Amazon ECS tasks running behind an Application Load Balancer (ALB). The developer wants to authenticate users and offload the verification of authentication tokens from the ECS tasks to the ALB. Which of the following configurations must the developer implement to meet these requirements? (Select TWO.)

  1. Configure an Amazon Cognito User Pool to manage user registration, sign-in, and group membership.Answer
  2. Configure a listener rule on the Application Load Balancer with an authenticate-cognito action to validate user tokens and forward user claims to the target group.Answer
  3. C
    Configure an Amazon Cognito Identity Pool to authenticate the users and generate temporary AWS credentials to authorize the Application Load Balancer listener.
  4. D
    Deploy an AWS Lambda function as a custom authorizer on the Application Load Balancer to decode and validate the Cognito user tokens manually.
  5. E
    Modify the IAM trust policy of the Amazon ECS Task Execution Role to allow the Cognito User Pool service principal to assume the role.

Answer

Configure an Amazon Cognito User Pool to manage user registration, sign-in, and group membership, and configure a listener rule on the Application Load Balancer with an authenticate-cognito action to validate user tokens and forward user claims to the target group.
To authenticate application users and offload token verification from Amazon ECS tasks to the Application Load Balancer, the developer must set up an Amazon Cognito User Pool for managing identities and configure the ALB listener rule to authenticate requests using Cognito. The ALB handles the authentication flow with the User Pool natively and forwards the user information in headers, securing the backend application without custom authentication logic.

Step-by-Step Solution

1
Set up the user directory and authentication flow.
An Amazon Cognito User Pool is created to handle user sign-up, sign-in, and manage user groups.
Cognito User Pools serve as the identity provider for authentication.
2
Configure the ALB listener to intercept and validate user traffic.
The Application Load Balancer listener rule is configured with an authenticate-cognito action pointing to the Cognito User Pool.
This offloads token verification from the ECS backend tasks to the load balancer, which then forwards user identity claims to the target ECS containers.

Key Concept

Offloading user authentication and validation to an Application Load Balancer using Amazon Cognito User Pools.
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic