Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is implementing a backend service integration for automated partner applications. The partner applications must programmatically upload raw telemetry data directly to an Amazon S3 bucket. The partners authenticate using their own enterprise OpenID Connect (OIDC) identity provider. The developer must ensure that these external applications obtain temporary AWS credentials with permission to write only to a specific folder in the S3 bucket without requiring long-lived IAM user credentials. Which TWO configuration steps should the developer perform to meet these requirements?

  1. Create and configure an Amazon Cognito identity pool, specifying the partner's OIDC provider as an authentication provider.Answer
  2. Associate an IAM role containing the required folder-level S3 write permissions with the authenticated identity role of the Cognito identity pool.Answer
  3. C
    Create an Amazon Cognito user pool, register the OIDC provider, and use user pool groups to grant direct access to the S3 bucket.
  4. D
    Implement an Amazon API Gateway Lambda authorizer that generates temporary IAM credentials using AWS STS and returns them in the context object.
  5. E
    Generate long-lived IAM access keys for a partner service account and configure the partner applications to use these keys in their SDK calls.

Answer

Create and configure an Amazon Cognito identity pool with the external OIDC provider as an authentication provider, and associate an IAM role containing the required folder-level S3 write permissions with the authenticated identity role of the identity pool.
To access AWS resources directly from an external identity provider (such as an OIDC provider), Amazon Cognito identity pools are used to vend temporary AWS credentials. The client first authenticates with the OIDC provider, passes the token to the identity pool, and receives temporary AWS credentials mapped to an IAM role. This role must have a trust policy allowing the identity pool to assume it and an IAM policy with the necessary S3 folder permissions.

Step-by-Step Solution

1
Select Cognito Identity Pools instead of User Pools for AWS resource authorization.
Allows external users to exchange credentials.
Identity pools are designed specifically to vend temporary AWS credentials for direct resource access.
2
Configure the OIDC provider in the identity pool authentication settings.
Enables trust relationship between external OIDC token and AWS STS.
Allows AWS Cognito to validate identity tokens presented by the partner applications.
3
Define an IAM policy with targeted S3 write access and bind it to the IAM role mapped for authenticated users.
Enforces least-privilege folder-level access for the partner applications.
Ensures that the vended temporary credentials only permit uploading to the designated S3 folder.

Key Concept

Amazon Cognito Identity Pools (Federated Identities) for vending temporary AWS credentials to external OIDC-authenticated users.
Estimated Time:2m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic