A gaming company is developing a new desktop application launcher. The launcher needs to authenticate players using external social identity providers and allow them to securely upload game save files directly to an Amazon S3 bucket. The developer wants to use Amazon Cognito to handle authentication and authorization.
Which two steps must the developer perform to meet these requirements?
- Configure an Amazon Cognito User Pool to handle player registration and integrate the social identity providers.Answer
- Create an Amazon Cognito Identity Pool, associate it with the User Pool, and map an IAM role to provide players with temporary AWS credentials.Answer
- CConfigure the Amazon Cognito User Pool to directly issue temporary AWS security credentials to authenticated players for S3 access.
- DConfigure an Amazon API Gateway REST API with a custom Lambda authorizer that generates temporary AWS credentials for S3 uploads.
- EConfigure an IAM trust policy that allows the desktop application's client credentials to directly call the AssumeRole API.
Answer
Configure an Amazon Cognito User Pool to handle player registration and integrate the social identity providers, and create an Amazon Cognito Identity Pool, associate it with the User Pool, and map an IAM role to provide players with temporary AWS credentials.
To securely authenticate players via social identity providers and authorize direct S3 uploads, the system must separate authentication and authorization. A Cognito User Pool is set up to handle player authentication and social identity providers, returning tokens. A Cognito Identity Pool is set up to exchange those tokens for temporary AWS IAM credentials, granting permission to write to S3.
Step-by-Step Solution
Key Concept
Authentication and authorization federation using Amazon Cognito User Pools and Identity Pools.
Alternative Method
An alternative method is to configure a backend server that receives Cognito User Pool tokens, verifies them, and calls AWS Security Token Service (STS) to generate temporary credentials, returning them to the client. However, using Cognito Identity Pools is the direct, standard, serverless, and recommended solution.
Estimated Time:2m 0s