Examkin

Question

Difficulty: EasyAmazon Cognito Authentication and Authorization

A developer is building a new web application that allows users to sign up, sign in, and download files directly from a private Amazon S3 bucket. The application must handle user directory management and authenticate users before granting them temporary access to S3. Which two Amazon Cognito resources should the developer configure to satisfy these authentication and authorization requirements?

  1. A Cognito User Pool to manage user registration, authentication, and the user directory.Answer
  2. A Cognito Identity Pool to exchange authentication tokens for temporary AWS credentials to access S3.Answer
  3. C
    A Cognito User Pool to directly generate temporary IAM credentials for accessing the Amazon S3 bucket.
  4. D
    A Cognito Identity Pool to store user profiles and handle password recovery emails.
  5. E
    A custom API Gateway Lambda Authorizer to validate Cognito tokens and generate AWS STS temporary credentials for client S3 access.

Answer

To meet the requirements, the developer must configure a Cognito User Pool to handle user directory management and authentication, and a Cognito Identity Pool to authorize access and provide temporary AWS credentials for the S3 bucket.
The correct solution involves configuring both a Cognito User Pool and a Cognito Identity Pool. The User Pool manages user directory services (registration, login, password recovery), and the Identity Pool handles authorization by exchanging the authenticated user's tokens for temporary AWS IAM credentials so the application can access the S3 bucket directly.

Step-by-Step Solution

1
Identify the authentication and directory management requirement.
Amazon Cognito User Pools must be configured because they act as the identity provider, handling registration, sign-in, and tokens.
User Pools are specifically designed to serve as a user directory and manage authentication flow.
2
Identify the authorization and AWS resource access requirement.
Amazon Cognito Identity Pools must be configured to federate the User Pool tokens.
Identity Pools are designed to exchange authentication tokens (such as OIDC tokens from a User Pool) for temporary AWS credentials via AWS STS.
3
Configure the client application to obtain S3 access.
The client app authenticates with the User Pool, sends the resulting token to the Identity Pool, receives temporary AWS credentials, and uses them to access the S3 bucket directly.
This flow leverages AWS best practices for secure web client interactions with AWS services.

Key Concept

Separation of concerns between Cognito User Pools (authentication/directory) and Cognito Identity Pools (authorization/AWS credentials).
Estimated Time:1m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic