Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A development team is building a mobile application for a bicycle-sharing service. The app allows users to log in using their social media accounts. The backend services expose a REST API hosted on Amazon API Gateway, backed by AWS Lambda. Additionally, the mobile app needs to upload user-generated profile photos directly to a private Amazon S3 bucket without routing the files through the application's backend.

Which two architectural steps should the developer take to implement authentication, API authorization, and secure S3 uploads with the least amount of custom code?

  1. Establish a user directory using Cognito User Pools, and deploy a built-in Cognito Authorizer on the API Gateway to secure the endpoints.Answer
  2. B
    Develop a custom Lambda authorizer that manually validates the identity tokens against the social provider, and secure the API Gateway using resource policies.
  3. Link a Cognito Identity Pool to the user directory to obtain temporary AWS credentials, enabling the mobile client to upload photos to the S3 bucket.Answer
  4. D
    Utilize the Cognito User Pool to directly exchange JSON Web Tokens (JWT) for temporary IAM credentials for S3 bucket access.
  5. E
    Configure an API Gateway Lambda Proxy integration that intercepts incoming requests and generates IAM execution policies dynamically for S3 upload.

Answer

Establish a user directory using Cognito User Pools, and deploy a built-in Cognito Authorizer on the API Gateway to secure the endpoints. Link a Cognito Identity Pool to the user directory to obtain temporary AWS credentials, enabling the mobile client to upload photos to the S3 bucket.
The correct solution uses Cognito User Pools for user authentication and secures the API Gateway REST API with the built-in Cognito Authorizer to minimize custom code. It then utilizes a Cognito Identity Pool linked to the User Pool to vend temporary AWS credentials, allowing the mobile application to upload profile photos directly to the private S3 bucket without passing through backend servers.

Step-by-Step Solution

1
Set up a user directory with Cognito User Pools to manage social identity federation and authentication.
Users are authenticated, and the mobile client receives identity and access tokens (JWTs).
This establishes user identities and allows built-in integration with external social providers.
2
Configure a built-in Cognito Authorizer on the API Gateway REST API.
API Gateway automatically validates the JWT signature and expiration before allowing requests to proceed to the Lambda backend.
This secures the API endpoints with minimal custom code by leveraging native API Gateway integrations.
3
Deploy a Cognito Identity Pool and link it to the User Pool as an identity provider, granting authenticated users an IAM role with write permissions to the S3 bucket.
The mobile app can exchange User Pool tokens for temporary AWS IAM credentials, allowing direct and secure uploads to S3.
This satisfies the requirement to write directly to S3 without routing files through backend servers.

Key Concept

Combining Cognito User Pools for user authentication/API authorization with Cognito Identity Pools for AWS resource access (S3 direct upload).
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic