Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is building a client proofing portal for a photography studio. The portal must authenticate clients using email and password, allow them to upload selection feedback files directly to a secure Amazon S3 bucket, and access private backend APIs on Amazon API Gateway. Which TWO actions must the developer take to configure the authentication and authorization flow?

  1. Set up a Cognito User Pool to handle user registration and sign-in, and configure a Cognito User Pool Authorizer on API Gateway to secure the APIs.Answer
  2. Set up a Cognito Identity Pool that uses the User Pool as an identity provider to obtain temporary AWS credentials for S3 bucket uploads.Answer
  3. C
    Set up a Cognito User Pool to generate temporary AWS credentials for S3 uploads using Cognito Sync.
  4. D
    Create a custom API Gateway Lambda Authorizer that decodes and validates the Cognito User Pool identity tokens to authorize API calls.
  5. E
    Create a Cognito Identity Pool to store user profiles and authenticate users directly via email and password.

Answer

To configure the authentication and authorization flow, the developer must set up a Cognito User Pool to manage authentication and secure the API Gateway using a Cognito User Pool Authorizer, and set up a Cognito Identity Pool referencing the User Pool to obtain temporary AWS credentials for S3 uploads.
The system requires a Cognito User Pool to handle user directory registration, login, and token generation. The backend APIs are secured with minimal complexity by using the native Cognito User Pool Authorizer on API Gateway. Direct uploads to Amazon S3 are enabled by exchanging the user token for temporary AWS credentials via a Cognito Identity Pool, which assumes an authenticated IAM role with the necessary S3 permissions.

Step-by-Step Solution

1
Configure a Cognito User Pool.
Establishes a user directory for client registration and authentication, issuing identity and access tokens (JWTs) upon successful login.
A User Pool is required to manage credentials and handle user sign-in.
2
Create a Cognito User Pool Authorizer on Amazon API Gateway.
API Gateway validates the token automatically for incoming requests without requiring custom code.
Using the native Cognito Authorizer reduces operational overhead and simplifies API security.
3
Create a Cognito Identity Pool and link it to the User Pool.
The client application can exchange User Pool tokens for temporary AWS credentials mapped to an IAM role with S3 write permissions.
An Identity Pool is necessary to delegate temporary AWS access for direct interaction with S3.

Key Concept

Amazon Cognito User Pools vs. Identity Pools and API Gateway Authorization
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic