A developer is building a mobile health-tracking application. Users will log in using an external OpenID Connect (OIDC) compliant identity provider. After logging in, the mobile application must upload raw telemetry log files directly to a private Amazon S3 bucket, and invoke a private REST API hosted on Amazon API Gateway to fetch user profile data. Which TWO Amazon Cognito configurations are required to support this architecture?
- A Cognito User Pool federated with the OIDC identity provider to handle user authentication and issue identity and access tokens.Answer
- A Cognito Identity Pool configured to accept the OIDC-federated tokens and assume an IAM role for temporary AWS credentials to upload files to Amazon S3.Answer
- CA Cognito User Pool group with an attached IAM role configured to directly authorize the client application to put objects into the S3 bucket.
- DAn API Gateway Lambda Authorizer configured to validate the OIDC tokens and generate temporary AWS credentials for the S3 bucket access.
- EAn API Gateway Cognito Authorizer configured to validate the OIDC tokens and return temporary AWS credentials to the mobile client.
Answer
To support this architecture, the developer must configure a Cognito User Pool federated with the OIDC identity provider to handle user authentication, and a Cognito Identity Pool to exchange the OIDC tokens for temporary AWS credentials to write to the Amazon S3 bucket.
To authenticate users through an external OIDC identity provider and obtain user directory tokens (such as identity or access tokens), a Cognito User Pool must be configured with federation. To allow the mobile application to upload files directly to a private S3 bucket without routing through a server, a Cognito Identity Pool is required to exchange the OIDC-federated tokens for temporary, limited-privilege AWS credentials.
Step-by-Step Solution
Key Concept
Distinction and integration between Amazon Cognito User Pools (authentication) and Cognito Identity Pools (authorization for AWS resources).