Examkin

Question

Difficulty: EasyAmazon Cognito Authentication and Authorization

An e-commerce application requires users to authenticate before they can download digital invoice PDFs directly from a private Amazon S3 bucket. The developer has set up user registration and authentication using Amazon Cognito. Which Cognito component must be configured to exchange the authenticated user session for temporary, limited-privilege AWS credentials?

  1. Cognito Identity PoolsAnswer
  2. B
    Cognito User Pools
  3. C
    API Gateway Lambda Authorizer
  4. D
    Cognito User Pool Authorizer

Answer

Cognito Identity Pools
Cognito Identity Pools (Federated Identities) enable applications to obtain temporary, limited-privilege AWS credentials. These credentials allow client applications to make direct calls to AWS services such as Amazon S3, using IAM roles associated with the authenticated or unauthenticated identity pool users.

Step-by-Step Solution

1
Identify the primary requirement: the client application needs temporary, limited-privilege AWS credentials to interact directly with an AWS service (Amazon S3).
Temporary AWS credentials (access key, secret key, and session token) are required.
Direct calls to S3 APIs from a client application require AWS credentials rather than standard OAuth/OIDC identity or access tokens.
2
Evaluate the difference between Cognito User Pools and Cognito Identity Pools.
User Pools manage the user directory and authentication, while Identity Pools provide AWS credentials (authorization) based on successful authentication.
To bridge the gap between user identity (authentication) and AWS permissions (authorization), Cognito Identity Pools must be configured.

Key Concept

Amazon Cognito Identity Pools are used to federate identities and obtain temporary AWS credentials for accessing AWS resources directly.
Estimated Time:45s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic