Examkin

Question

Difficulty: HardApplication Authentication and Authorization with Amazon Cognito

A developer is designing a secure integration between an external third-party server-to-server daemon application and a private API hosted on Amazon API Gateway. The external application must programmatically access API endpoints to retrieve financial reports without user intervention. The solution must support custom OAuth 2.0 scopes, such as `reports:read`, to authorize access. Which architecture should the developer implement to meet these requirements with the least operational complexity?

  1. A
    Configure an Amazon Cognito Identity Pool with a resource server defining the `reports:read` scope. Create an app client, enable the Client Credentials grant, and assign the custom scope. On API Gateway, configure an IAM Authorizer and assign an IAM role to the identity pool that allows API access.
  2. Configure an Amazon Cognito User Pool with a resource server defining the `reports:read` scope. Create an app client, enable the Client Credentials grant, and assign the custom scope. On API Gateway, configure a Cognito Authorizer and specify the `reports:read` scope in the API method's authorization settings.Answer
  3. C
    Configure an Amazon Cognito User Pool with a resource server defining the `reports:read` scope. Create an app client, enable the Authorization Code flow with PKCE, and assign the scope. On API Gateway, deploy a custom Lambda Authorizer to validate the JWT signature, extract the scope, and permit or deny access.
  4. D
    Configure an Amazon Cognito User Pool. Create an IAM role for the third-party application, and configure its IAM trust policy to trust the `cognito-idp.amazonaws.com` service principal. On API Gateway, use AWS_IAM authorization, and configure the Cognito User Pool to directly assume the IAM role and sign requests using AWS Signature Version 4.

Answer

Configure an Amazon Cognito User Pool with a resource server defining the reports:read scope, enable the Client Credentials grant on the app client, and use API Gateway's built-in Cognito Authorizer.
The correct solution uses Amazon Cognito User Pools, which natively support the OAuth 2.0 Client Credentials grant flow for server-to-server (daemon) authentication. By configuring a Resource Server in the User Pool, the developer can define custom scopes like `reports:read`. The built-in API Gateway Cognito Authorizer can validate the incoming Access Token (JWT) and enforce authorization based on the configured custom scopes directly on the API method, requiring no custom Lambda authorizer code or IAM role assumption.

Step-by-Step Solution

1
Set up a resource server in the User Pool.
Defines the custom oauth scope `reports:read` under a custom identifier.
This establishes the scope structure that API Gateway will use to validate client access.
2
Configure the app client with Client Credentials flow.
Allows the external daemon to request tokens using its client ID and client secret, bypassing user interactive login.
Machine-to-machine authentication requires the client credentials grant type.
3
Integrate with API Gateway Cognito Authorizer.
Validates the incoming JWT access token and verifies the presence of the `reports:read` scope.
Provides declarative authorization without writing custom Lambda authorizer code.

Key Concept

Machine-to-machine authentication using Amazon Cognito User Pools and Client Credentials flow with API Gateway Integration
Estimated Time:2m 0s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic