Examkin

Question

Difficulty: HardAmazon Cognito Authentication and Authorization

A developer is implementing a serverless analytics dashboard. Users must register and log in to the dashboard, which is built as a single-page application (SPA). The application needs to call secure endpoints on Amazon API Gateway to fetch user profile data. Additionally, the client-side application must publish telemetry logs directly to an Amazon Kinesis Data Stream for real-time analysis. Which TWO steps should the developer perform to meet these security requirements with the least operational overhead?

  1. Configure a Cognito User Pool to manage user authentication, and create a Cognito User Pool Authorizer in API Gateway to validate the ID tokens sent in the HTTP request headers.Answer
  2. Create a Cognito Identity Pool that uses the User Pool as an identity provider, and assign an authenticated IAM role with permissions to write to the Kinesis Data Stream.Answer
  3. C
    Develop a custom Lambda Authorizer in API Gateway that parses the Cognito User Pool access token, performs manual verification against the public JWKS endpoint, and generates an IAM policy for the REST API.
  4. D
    Configure API Gateway to use AWS_IAM authorization, and utilize the Cognito User Pool directly to issue temporary IAM credentials for signing requests to the REST API.
  5. E
    Integrate the Kinesis Data Stream with the Cognito User Pool, configuring a User Pool client-side policy to grant stream write permissions to authenticated users.

Answer

To meet the requirements with the least operational overhead, the developer should configure a Cognito User Pool with a Cognito Authorizer in API Gateway to secure the API endpoints, and use a Cognito Identity Pool linked to the User Pool to provide temporary IAM credentials that grant write permissions to the Kinesis Data Stream.
The correct solution uses the native features of AWS services to minimize custom code. By configuring a Cognito User Pool, the developer establishes a user directory. Setting up a Cognito User Pool Authorizer on API Gateway allows the platform to natively inspect and validate the ID tokens. To interact with Amazon Kinesis directly from the client, the developer uses a Cognito Identity Pool to trade the User Pool's JWTs for temporary, restricted AWS IAM credentials, which contain permission to execute the write action on the stream.

Step-by-Step Solution

1
Configure a Cognito User Pool to provide user authentication and management for the single-page application.
The application can authenticate users and receive JSON Web Tokens (ID, Access, and Refresh tokens).
User Pools act as the primary user directory and handle user registration and login flows.
2
Create a Cognito User Pool Authorizer on the API Gateway REST API and configure it to validate the incoming ID tokens in the Authorization header.
API Gateway automatically validates the signature, expiration, and audience of the JWTs without requiring custom Lambda code.
This utilizes the native API Gateway integration to minimize operational overhead and custom code.
3
Set up a Cognito Identity Pool (Federated Identities) and configure the Cognito User Pool as an authentication provider.
The identity pool can federate users authenticated by the user pool and exchange their JWTs for temporary AWS IAM credentials.
Identity Pools are designed to authorize access to AWS resources by issuing temporary AWS credentials.
4
Assign an IAM role to authenticated users in the Identity Pool with a policy that allows the 'kinesis:PutRecord' action on the target stream.
Authenticated users obtain temporary AWS credentials with permissions to publish telemetry logs directly from the browser SDK.
This establishes fine-grained authorization to access AWS resources directly from client-side code.

Key Concept

Integration of Cognito User Pools for user directory authentication, Cognito Identity Pools for authorizing direct AWS resource access (such as S3, DynamoDB, or Kinesis) via temporary credentials, and API Gateway Cognito Authorizers for securing REST endpoints.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic