Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A company is developing a desktop-based administration client that must allow authenticated internal users to upload system logs directly to a secure Amazon S3 bucket. The developer wants to manage user registration, sign-in, and password recovery natively within the client, while ensuring that the desktop application receives temporary, limited-privilege AWS credentials to perform the S3 uploads without embedding long-term AWS access keys.

Which architecture should the developer implement to meet these requirements?

  1. Use an Amazon Cognito User Pool to manage user authentication, and use an Amazon Cognito Identity Pool to exchange the User Pool identity tokens for temporary AWS IAM credentials that authorize writing to the Amazon S3 bucket.Answer
  2. B
    Use an Amazon Cognito Identity Pool to manage user registration and directory management, and configure an AWS Lambda post-confirmation trigger to return temporary AWS credentials directly to the client.
  3. C
    Use an Amazon Cognito User Pool to authenticate users, and configure an Amazon API Gateway REST API with a Cognito Authorizer to generate and return temporary AWS credentials to the desktop client.
  4. D
    Use an Amazon Cognito User Pool to authenticate users, and configure an IAM User with a resource-based trust policy that allows the desktop application to assume the user identity based on client IP addresses.

Answer

Use an Amazon Cognito User Pool to manage user authentication, and use an Amazon Cognito Identity Pool to exchange the User Pool identity tokens for temporary AWS IAM credentials that authorize writing to the Amazon S3 bucket.
The correct architecture uses a Cognito User Pool to authenticate the desktop client users (handling registration, login, etc.) and generate JWT identity tokens. The client then passes this token to a Cognito Identity Pool, which validates it and returns temporary, restricted AWS IAM credentials. The desktop client can then use these credentials to upload files directly to S3.

Step-by-Step Solution

1
Configure an Amazon Cognito User Pool.
Creates a user directory that handles user sign-up, sign-in, password reset, and produces JWT tokens (ID, Access, and Refresh tokens) upon successful authentication.
Required to handle native user authentication and directory management.
2
Configure an Amazon Cognito Identity Pool (Federated Identities) and associate it with the User Pool as an identity provider.
Allows the application to exchange the ID token issued by the User Pool for temporary AWS credentials.
Provides the mechanism to federate Cognito User Pool users into AWS IAM roles.
3
Define an IAM Role for authenticated users with a trust policy for Cognito Identity Pools and a permissions policy allowing S3 put-object actions.
Ensures that users mapped by the Identity Pool receive credentials scoped strictly to write to the designated S3 bucket.
Enforces least-privilege access for the S3 bucket operations.

Key Concept

Amazon Cognito User Pools vs Identity Pools
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic