A team is migrating an on-premises desktop application to a cloud-native model. The application requires users to authenticate against a central directory and then obtain temporary, limited-privilege AWS credentials to retrieve configuration objects directly from an Amazon DynamoDB table. Which configuration steps must the team implement to meet these requirements? (Select TWO.)
- Configure a user pool in Amazon Cognito to manage the user directory and handle user authentication.Answer
- Configure an identity pool in Amazon Cognito, link it to the user pool, and define an authenticated IAM role that allows DynamoDB access.Answer
- CConfigure a user pool in Amazon Cognito to vend temporary AWS credentials directly to the application, and use an identity pool to maintain the user directory.
- DCreate an Amazon API Gateway Lambda authorizer to authenticate users and generate temporary AWS credentials to access the DynamoDB table.
- EConfigure an IAM role with a trust policy that trusts the DynamoDB service principal, allowing the desktop application to assume the role directly.
Answer
Configure a user pool in Amazon Cognito to manage the user directory and handle user authentication, and configure an identity pool in Amazon Cognito, link it to the user pool, and define an authenticated IAM role that allows DynamoDB access.
To meet the requirements, the team must use a user pool in Amazon Cognito to handle user directory management and authentication. Then, they must link this user pool to an Amazon Cognito identity pool, which handles authorization by vending temporary AWS credentials to authenticated users via an IAM role.
Step-by-Step Solution
Key Concept
Separation of authentication (Cognito User Pools) and authorization (Cognito Identity Pools) for direct AWS resource access using IAM roles.