Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is building a mobile gaming application that requires authenticated users to save their game progress files directly to an Amazon S3 bucket. The game progress files must be stored in a folder path specific to each user. Additionally, the application needs to call a secure REST API hosted on Amazon API Gateway to post high scores. The developer wants to use Amazon Cognito for authentication and authorization with the least operational overhead.

Which TWO configurations must the developer implement to meet these requirements?

  1. Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and map authenticated users to an IAM role that grants access to the S3 bucket using the cognito-identity.amazonaws.com:sub variable in the resource path policy.Answer
  2. Configure an API Gateway Cognito Authorizer on the REST API methods, and configure the mobile app to include the Cognito User Pool identity token in the Authorization header of the requests.Answer
  3. C
    Enable S3 bucket policies that grant read and write permissions to the Cognito User Pool client ID, and configure the mobile app to pass the Cognito access token directly to S3 APIs.
  4. D
    Deploy a custom Lambda Authorizer in API Gateway to parse the JSON Web Token, verify the cryptographic signature, and return an IAM policy allowing access to the REST API.
  5. E
    Implement a backend database routine to dynamically provision individual IAM Users and temporary access keys for each authenticated client, storing these access keys on the mobile device's local storage.

Answer

Create an Amazon Cognito Identity Pool to exchange User Pool tokens for temporary AWS credentials with user-specific S3 paths, and configure an API Gateway Cognito Authorizer to validate the Cognito identity token.
To secure the mobile game progress files in S3 and restrict access to user-specific folders, the developer must use Cognito Identity Pools to exchange User Pool tokens for temporary AWS IAM credentials. By defining an IAM policy using the cognito-identity.amazonaws.com:sub variable, the app enforces path-based access control. Concurrently, to validate incoming User Pool JWT tokens at API Gateway with minimal overhead, the developer should configure the built-in Cognito Authorizer on the REST API resources.

Step-by-Step Solution

1
Configure user authentication using an Amazon Cognito User Pool.
The mobile app can authenticate users, obtaining JSON Web Tokens (JWTs) including identity and access tokens.
This establishes user identities and handles authentication securely.
2
Integrate the Amazon Cognito User Pool with API Gateway.
An API Gateway Cognito Authorizer is configured to inspect the Authorization header and validate incoming identity tokens.
This secures API Gateway REST endpoints with minimal operational overhead.
3
Integrate the Amazon Cognito User Pool with a Cognito Identity Pool.
Authenticated users can exchange their JWTs for temporary AWS IAM credentials.
This allows the mobile client to make direct, secure API calls to Amazon S3.
4
Apply an IAM role policy to the Identity Pool's authenticated role using the cognito-identity.amazonaws.com:sub variable.
Users are restricted to accessing only S3 objects within their specific folder path.
This ensures data isolation and enforces the principle of least privilege.

Key Concept

Amazon Cognito User Pools handle user directory and authentication, whereas Cognito Identity Pools provide authorization to AWS resources by granting temporary IAM credentials. API Gateway Cognito Authorizers easily validate User Pool JWTs without custom code.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic