Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is designing a mobile photo-sharing application that allows users to authenticate using social identity providers. The application must store photos in user-specific folders within an Amazon S3 bucket. Additionally, the application needs to call a secure backend REST API hosted on Amazon API Gateway. Which TWO steps should the developer perform to implement this authentication and authorization flow with the least operational complexity?

  1. Create an Amazon Cognito User Pool to handle user authentication, federation with social identity providers, and token generation.Answer
  2. Create an Amazon Cognito Identity Pool, integrate it with the User Pool, and map an IAM role to obtain temporary AWS credentials for S3 access.Answer
  3. C
    Configure the Amazon Cognito User Pool to directly issue temporary AWS security credentials to the mobile client for S3 bucket access.
  4. D
    Implement a custom API Gateway Lambda Authorizer that parses the user pool token, assumes an IAM role, and returns temporary security credentials to the client.
  5. E
    Configure the Amazon Cognito Identity Pool to store user attributes, manage password strength policies, and handle multi-factor authentication (MFA).

Answer

To implement this flow, the developer should create an Amazon Cognito User Pool to handle user authentication and social provider federation, and create an Amazon Cognito Identity Pool linked to the User Pool to authorize users by providing temporary AWS IAM credentials for S3 access.
For the social identity authentication, the application needs an Amazon Cognito User Pool to serve as the user directory and handle federation. To authorize the client to upload files to Amazon S3, the application must exchange the User Pool tokens for temporary AWS security credentials, which is the primary function of an Amazon Cognito Identity Pool.

Step-by-Step Solution

1
Set up authentication
Configure an Amazon Cognito User Pool, set up social identity providers, and establish client application settings to receive JWTs upon successful sign-in.
This establishes the identity directory and federated login capabilities for the mobile application.
2
Set up authorization for AWS resources
Configure an Amazon Cognito Identity Pool, register the User Pool as an identity provider, and associate an IAM role with permissions to the specific S3 folder.
This allows the authenticated user's JWTs to be exchanged for temporary, scoped AWS credentials, granting the client application access to Amazon S3.

Key Concept

Separation of concerns between Cognito User Pools (authentication and user directory) and Cognito Identity Pools (authorization and temporary AWS credentials generation).
Estimated Time:2m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic