Examkin

Question

Difficulty: HardAmazon Cognito Authentication and Authorization

A developer is building a single-page web application (SPA) that will allow users to authenticate using Amazon Cognito User Pools and access backend services through Amazon API Gateway. Since the SPA runs entirely in the user's browser, the client credentials cannot be kept secure. The developer wants to implement a secure authentication flow using the authorization code grant with Proof Key for Code Exchange (PKCE) and validate access at the API Gateway layer. Which TWO steps should the developer take to implement this architecture?

  1. Configure the Amazon Cognito User Pool app client with client secret generation disabled, and enable the Authorization Code Grant OAuth flow.Answer
  2. B
    Configure the Amazon Cognito User Pool app client with client secret generation enabled, and retrieve the secret at runtime using AWS Secrets Manager inside the browser.
  3. Create an Amazon API Gateway Cognito User Pool authorizer to validate the signature and expiration of the identity or access tokens passed in the Request header.Answer
  4. D
    Create an API Gateway custom Lambda Authorizer that performs an HTTPS POST request to the Cognito token endpoint to validate the token on every incoming request.
  5. E
    Configure an Amazon Cognito Identity Pool to exchange the authorization code directly for temporary AWS credentials, and configure IAM authorization on API Gateway.

Answer

The correct steps are to configure the user pool app client without a client secret while enabling the authorization code grant flow, and to create an API Gateway Cognito User Pool authorizer to validate incoming tokens.
The correct options state that the Cognito User Pool app client must be configured with client secret generation disabled while enabling the authorization code grant flow, and that a built-in API Gateway Cognito User Pool authorizer should be created to validate the tokens. For public clients like single-page applications running in the browser, exposing a client secret is a security risk. Therefore, client secret generation is disabled, and PKCE is utilized to secure the authorization code grant. API Gateway's native Cognito authorizer can automatically validate the JWT signature, issuer, and expiration locally using public keys from the User Pool's JSON Web Key Set (JWKS), minimizing overhead.

Step-by-Step Solution

1
Disable client secret generation for the app client.
The client application (SPA) can safely initiate the authentication flow without needing to store or protect a secret.
Single-page applications run entirely in the browser, making it impossible to protect client secrets. Using the authorization code grant with PKCE mitigates the need for a client secret.
2
Enable the Authorization Code Grant flow in the Cognito app client settings.
Cognito is configured to exchange authorization codes for access and identity tokens securely.
This OAuth grant type, combined with PKCE, is the industry standard for securing public web applications.
3
Configure an Amazon API Gateway Cognito User Pool authorizer.
API Gateway automatically intercepts requests, validates the signature and expiration of the JWTs, and permits or denies access.
This native integration validates JSON Web Tokens (JWTs) locally using Cognito's public key set, removing the need for a custom Lambda authorizer and reducing latency.

Key Concept

Securing public clients and verifying tokens using Amazon Cognito User Pools and API Gateway native authorizers.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic