Examkin

Question

Difficulty: HardApplication Authentication and Authorization with Amazon Cognito

A developer is designing a native mobile application that requires users to authenticate. Once logged in, the application must allow users to upload files directly to their own dedicated folders in an Amazon S3 bucket. Additionally, the application must call a backend REST API hosted on Amazon API Gateway that requires user authentication. The developer wants to implement a secure solution that minimizes custom code and management overhead.

Which two configuration steps should the developer perform to meet these requirements? (Select TWO.)

  1. Create an Amazon Cognito Identity Pool, specify the User Pool as an identity provider, and associate an authenticated IAM role that allows access to user-specific S3 paths.Answer
  2. Configure a Cognito User Pool authorizer on the API Gateway REST API, and configure the application to pass the ID token in the authorization header.Answer
  3. C
    Configure the Amazon Cognito User Pool client settings to directly generate temporary AWS IAM credentials for the client app to access the S3 bucket.
  4. D
    Create a custom API Gateway Lambda authorizer that decodes, parses, and validates the Cognito User Pool token signatures on each API request.
  5. E
    Define the S3 bucket read and write permission statements inside the trust policy document of the IAM role assumed by Cognito authenticated users.

Answer

Create an Amazon Cognito Identity Pool linked to the User Pool for S3 access, and use a built-in Cognito User Pool authorizer on API Gateway.
The correct options recommend creating an Amazon Cognito Identity Pool and configuring a built-in Cognito User Pool authorizer. Amazon Cognito User Pools handle user directory services, registration, and authentication (generating JWT tokens). Amazon Cognito Identity Pools enable authorization by exchanging these JWT tokens for temporary AWS IAM credentials, which are required for direct interactions with AWS services like Amazon S3. For the REST API on Amazon API Gateway, using the built-in Cognito User Pool authorizer is the most efficient and low-overhead method to validate User Pool tokens (ID tokens) without writing custom Lambda authorizer code.

Step-by-Step Solution

1
Differentiate between authentication and authorization requirements for direct AWS resource access vs API endpoints.
Identified that User Pools authenticate users, while Identity Pools authorize access to AWS resources (S3) by vending temporary credentials.
This establishes the necessary Cognito services to include in the architecture.
2
Select the most efficient API Gateway authorizer type for User Pool JWT tokens.
Chose the built-in Cognito User Pool Authorizer rather than a custom Lambda authorizer.
Using the built-in authorizer reduces development overhead, avoids execution costs, and simplifies configuration.
3
Configure the security policies for the IAM roles assumed via Cognito Identity Pools.
Linked the S3 access policy to the IAM permissions policy and verified that the trust relationship policy only specifies the Cognito service principal.
This ensures IAM credentials can be assumed correctly and carry the proper fine-grained access permissions.

Key Concept

Amazon Cognito User Pools vs. Identity Pools and API Gateway Authorization
Estimated Time:2m 0s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic