Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A developer is building a serverless web application that allows users to authenticate using external social identity providers (Google and Apple). After logging in, users must be able to upload files directly to a private Amazon S3 bucket. The frontend application runs in the user's browser.

Which two steps should the developer perform to configure authentication and authorization for this application? (Select TWO.)

  1. Configure an Amazon Cognito user pool with Google and Apple as social identity providers to manage user authentication and issue identity tokens.Answer
  2. Configure an Amazon Cognito identity pool using the user pool as an identity provider, and link it to an authenticated IAM role that permits S3 PutObject operations.Answer
  3. C
    Configure an Amazon Cognito user pool to directly issue temporary AWS credentials to the frontend client, and attach an IAM policy with S3 write permissions to the user pool client.
  4. D
    Configure an Amazon API Gateway REST API with a custom Lambda authorizer that validates the authentication tokens, assumes an IAM role using AWS STS, and returns temporary AWS credentials to the client.
  5. E
    Configure an IAM role with S3 write permissions, edit its trust policy to trust the Amazon S3 service principal, and assign this role directly to the Amazon Cognito user pool.

Answer

The correct configurations are to configure an Amazon Cognito user pool with Google and Apple as social identity providers to manage user authentication, and configure an Amazon Cognito identity pool using the user pool as an identity provider linked to an authenticated IAM role that permits S3 PutObject operations.
To support authentication with external social providers and direct access to AWS resources like Amazon S3 from a client-side application, a combination of Amazon Cognito user pools and identity pools is required. The user pool acts as the user directory and manages federation with Google and Apple, returning identity tokens upon successful login. The identity pool then exchanges these tokens for temporary AWS credentials by assuming an authenticated IAM role. This IAM role contains the permission policy permitting write access to S3, and its trust policy allows the identity pool service to assume the role.

Step-by-Step Solution

1
Configure user authentication using a Cognito user pool.
Users can log in using Google or Apple and receive JSON Web Tokens (JWTs) representing their identity.
Cognito User Pools serve as the identity provider and directory to authenticate users via external social providers.
2
Configure a Cognito identity pool to exchange the tokens for AWS credentials.
The identity pool exchanges the JWTs for temporary, limited-privilege AWS credentials.
Cognito Identity Pools handle authorization by mapping authenticated user identities to IAM roles that permit direct access to AWS services.
3
Associate an authenticated IAM role with the identity pool that grants S3 permissions.
The client application receives temporary credentials allowing it to execute PutObject calls to the S3 bucket.
An IAM role must have a trust policy allowing Cognito Identity Pools to assume it, and a permissions policy granting access to the S3 bucket.

Key Concept

Separation of authentication and authorization using Amazon Cognito User Pools and Identity Pools.
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic