Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A developer is building a serverless web application. The frontend is a Single-Page Application (SPA). Users must sign in to the application, and the application must perform two main functions:
1. Call a secure REST API hosted on Amazon API Gateway.
2. Download user-specific reports directly from a private Amazon S3 bucket.

Which combination of Amazon Cognito features and configurations should the developer use to meet these requirements? (Select TWO.)

  1. Configure an Amazon Cognito User Pool to manage user registration and authentication, and implement an Amazon Cognito User Pool authorizer on the API Gateway REST API.Answer
  2. Configure an Amazon Cognito Identity Pool linked to the User Pool, and associate an IAM role that grants read-only permissions to the Amazon S3 bucket.Answer
  3. C
    Configure an Amazon Cognito Identity Pool to manage the user directory and issue JSON Web Tokens (JWTs) to authenticate requests at API Gateway.
  4. D
    Configure a custom API Gateway Lambda Authorizer to assume an IAM role for S3 access and return the temporary AWS credentials to the client in the API response.
  5. E
    Configure the IAM trust policy of the S3 access role to trust the Cognito User Pool (cognito-idp.amazonaws.com) directly.

Answer

To secure the API Gateway REST API, the developer should configure an Amazon Cognito User Pool to manage user authentication and use a User Pool authorizer on API Gateway. To allow the client to download files directly from S3, the developer should configure an Amazon Cognito Identity Pool linked to the User Pool and associate it with an IAM role that grants S3 read access.
The correct solution involves configuring an Amazon Cognito User Pool to handle user directory, registration, and sign-in. An API Gateway Cognito User Pool Authorizer can then easily validate the ID or access token (JWT) sent by the client. For the S3 download requirement, the developer must configure an Amazon Cognito Identity Pool linked to the User Pool. The client submits the User Pool JWT to the Identity Pool, which returns temporary AWS credentials associated with an IAM role that grants read access to the S3 bucket.

Step-by-Step Solution

1
Determine user authentication and API authorization mechanism.
Use Amazon Cognito User Pools to authenticate users and generate JWTs. Configure API Gateway to use a Cognito User Pool authorizer to validate these JWTs.
User Pools manage the user directory and authentication, and API Gateway natively integrates with them for authentication.
2
Determine client-side AWS resource access mechanism.
Configure an Amazon Cognito Identity Pool and link it to the User Pool as an authentication provider.
Identity Pools are designed to exchange authentication tokens from an identity provider (like User Pools) for temporary AWS credentials.
3
Define and associate permissions for S3 access.
Create an IAM role with S3 read permissions and configure the Identity Pool to assume this role for authenticated users.
This allows the client application to obtain temporary AWS credentials with limited access to perform S3 read operations directly.

Key Concept

Distinguishing between Amazon Cognito User Pools (authentication and API authorization) and Identity Pools (AWS resource authorization via temporary credentials).
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic