Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is building a personal finance application. Users must be able to sign up, sign in, and access secured REST API endpoints on Amazon API Gateway. Additionally, users must be able to upload scanned monthly statements directly to a private Amazon S3 bucket. Which architecture meets these requirements with the least operational overhead?

  1. Use an Amazon Cognito User Pool for user registration and authentication, configure an API Gateway Cognito user pool authorizer to secure the API endpoints, and use an Amazon Cognito Identity Pool to grant authenticated users temporary AWS credentials for the Amazon S3 uploads.Answer
  2. B
    Use an Amazon Cognito Identity Pool for user registration and authentication, configure an API Gateway Cognito user pool authorizer to secure the API endpoints, and use an Amazon Cognito User Pool to grant authenticated users temporary AWS credentials for the Amazon S3 uploads.
  3. C
    Use an Amazon Cognito User Pool for user registration and authentication, write a custom Lambda authorizer to manually parse and validate the Cognito JSON Web Tokens (JWT) for the API endpoints, and use an Amazon Cognito Identity Pool to grant authenticated users temporary AWS credentials for the Amazon S3 uploads.
  4. D
    Use an Amazon Cognito User Pool for user registration and authentication, configure an API Gateway Cognito user pool authorizer to secure the API endpoints, and configure the application client with an IAM user's long-term access keys to handle the Amazon S3 uploads.

Answer

Use an Amazon Cognito User Pool for user registration and authentication, configure an API Gateway Cognito user pool authorizer to secure the API endpoints, and use an Amazon Cognito Identity Pool to grant authenticated users temporary AWS credentials for the Amazon S3 uploads.
The correct architecture uses a Cognito User Pool to handle user registration and login, an API Gateway Cognito user pool authorizer to secure REST API endpoints with no coding effort, and a Cognito Identity Pool to dynamically exchange user pool tokens for temporary IAM credentials that authorize the client application to upload files directly to S3.

Step-by-Step Solution

1
Set up user authentication and directory services.
Create an Amazon Cognito User Pool to manage user registration, sign-in, and user attributes.
A User Pool serves as a user directory and issues JSON Web Tokens (JWT) upon successful authentication.
2
Protect the REST API endpoints in API Gateway.
Create a built-in Cognito User Pool authorizer in API Gateway and configure the API methods to require this authorizer.
Using the built-in Cognito authorizer allows API Gateway to natively validate the user's ID or access tokens without requiring custom Lambda code, minimizing operational overhead.
3
Configure secure access to Amazon S3.
Create an Amazon Cognito Identity Pool, specify the User Pool as the authentication provider, and map authenticated users to an IAM role with write permissions to the destination S3 bucket.
Cognito Identity Pools authorize access to AWS resources by exchanging external authentication tokens for scoped, temporary AWS credentials.

Key Concept

Distinction between Amazon Cognito User Pools (authentication) and Cognito Identity Pools (authorization to access AWS resources), alongside native API Gateway Cognito authorizer integration.
Estimated Time:2m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic