Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A developer is designing a server-to-server integration where a partner company's backend application must programmatically invoke a private REST API hosted on Amazon API Gateway. The partner application needs to access the API without any interactive user login. The developer wants to use Amazon Cognito to authenticate and authorize the client application requests. Which combination of steps should the developer perform to securely configure this authentication flow? (Select TWO.)

  1. Configure a Cognito User Pool with a resource server defining custom scopes. Create an app client, enable the client credentials flow, and associate the custom scopes with the app client.Answer
  2. Configure a Cognito User Pool authorizer in API Gateway. For the API methods, set the authorization type to use this authorizer, and add the custom scopes to the OAuth Scopes method configuration.Answer
  3. C
    Configure a Cognito Identity Pool to exchange client credentials for temporary IAM credentials, and configure the API Gateway API methods to use AWS_IAM authorization.
  4. D
    Create a custom API Gateway Lambda authorizer to parse and validate client credentials in the authorization header, as Cognito User Pool authorizers only support authorization code and implicit flows.
  5. E
    Configure the API Gateway method to use AWS_IAM authorization, and edit the IAM role's trust policy to allow the Cognito User Pool service principal (cognito-idp.amazonaws.com) to assume the role directly.

Answer

Configure an Amazon Cognito User Pool with a resource server, client credentials flow, and custom scopes, then secure the API Gateway methods using a Cognito User Pool authorizer configured with those custom scopes.
To secure server-to-server communication without interactive user login, the developer should use the OAuth 2.0 client credentials flow. This is achieved by creating an Amazon Cognito User Pool, defining a resource server with custom scopes, and setting the app client to allow the client credentials flow. On the API Gateway side, a built-in Cognito User Pool authorizer can validate the resulting JWT access tokens. By configuring the OAuth Scopes on the API Gateway methods, API Gateway will automatically verify that the client has the required scopes before granting access.

Step-by-Step Solution

1
Set up Cognito User Pool credentials flow.
An app client is configured to allow the client_credentials OAuth flow, and a resource server defines the custom scopes that the partner application can request.
This allows the partner application to authenticate programmatically using its client ID and client secret, obtaining an access token without requiring user interaction.
2
Secure API Gateway using the Cognito User Pool.
A Cognito User Pool authorizer is created in API Gateway, and the targeted method is configured to use this authorizer with the custom OAuth scopes.
This ensures that API Gateway automatically validates the signature of the incoming JWT access token and checks that the token contains the authorized scopes.

Key Concept

Securing server-to-server integrations using Amazon Cognito User Pools OAuth 2.0 client credentials flow and API Gateway authorizers.
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic