Examkin

Question

Difficulty: MediumResolving IAM and Authorization Failures

A developer is building a mobile application that needs to upload user-generated files directly to a private Amazon S3 bucket. The developer has configured an Amazon Cognito User Pool to handle user registration and sign-in. After successfully logging in, users receive JSON Web Tokens (JWTs), but the application receives an Access Denied error (HTTP 403) when attempting to upload files using the AWS SDK. Which two actions should the developer take to resolve this authorization failure? (Select TWO.)

  1. Create and configure an Amazon Cognito Identity Pool, specifying the Cognito User Pool as the authentication provider.Answer
  2. Attach an IAM policy to the Cognito Identity Pool's authenticated IAM role that allows the s3:PutObject action on the target S3 bucket.Answer
  3. C
    Attach an IAM policy granting the s3:PutObject action directly to the Cognito User Pool client app configuration.
  4. D
    Configure an Amazon API Gateway REST API with a custom Lambda authorizer to validate the JWT and proxy the upload requests to S3.
  5. E
    Embed an IAM User's long-term access key and secret access key in the mobile application code to initialize the AWS SDK client.

Answer

Create and configure an Amazon Cognito Identity Pool with the User Pool as the authentication provider, and attach an IAM policy allowing the s3:PutObject action to the authenticated IAM role associated with the Identity Pool.
To resolve the authorization failure for direct S3 uploads, the application needs to use an Amazon Cognito Identity Pool to exchange Cognito User Pool tokens for temporary AWS credentials, and the authenticated IAM role associated with the Identity Pool must have an IAM policy attached that grants the s3:PutObject permission.

Step-by-Step Solution

1
Integrate Cognito Identity Pools
The application can now exchange authentication tokens for temporary AWS security credentials.
Cognito User Pools only authenticate users (providing identity tokens), but Cognito Identity Pools are required to authorize users to access AWS services directly by providing temporary AWS credentials.
2
Define permissions for authenticated users
The authenticated IAM role is configured with write permissions to the S3 bucket.
Once the identity pool is established, AWS assigns an IAM role to authenticated users. This role must carry the specific permissions (such as s3:PutObject) required to perform actions on the target AWS resource.

Key Concept

Federated identities in Cognito require both a User Pool for authentication and an Identity Pool for authorizing direct access to AWS resources using IAM roles.
Estimated Time:2m 0s
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic