Examkin

Question

Difficulty: Very hardApplication Authentication and Authorization with Amazon Cognito

A developer is designing a security architecture for a native mobile application. The application must support user authentication using a corporate SAML 2.0 Identity Provider (IdP). Once authenticated, the application needs to:

1. Upload documents directly to a tenant-specific folder in an Amazon S3 bucket, where the folder name corresponds to the user's Cognito identity ID.
2. Invoke an Amazon API Gateway REST API, where access must be restricted based on the user's group membership (such as 'Finance' or 'Engineering') mapped from the corporate IdP. The authorization decision must be evaluated at the API Gateway layer without invoking a custom AWS Lambda function for token validation, to minimize latency and operational overhead.

Which architectural design meets these requirements while adhering to the principle of least privilege?

  1. A
    Configure an Amazon Cognito User Pool federated with the SAML IdP, mapping group claims to Cognito groups. Set up an Amazon Cognito Identity Pool with the User Pool as the provider, configured to resolve the IAM role from the user's token. Secure the API Gateway REST API with AWS_IAM authorization, and configure the trust policies of the assumed IAM roles to trust the API Gateway service principal.
  2. B
    Configure an Amazon Cognito Identity Pool to federate directly with the SAML IdP. Configure the mobile client to retrieve temporary AWS credentials from the Identity Pool and use them to obtain a JSON Web Token (JWT) directly from the Identity Pool. Secure the API Gateway REST API using a Cognito User Pool Authorizer to validate this JWT.
  3. Configure an Amazon Cognito User Pool federated with the SAML IdP, mapping group claims to Cognito groups. Set up an Amazon Cognito Identity Pool with the User Pool as the provider, configured to resolve the IAM role from the user's token. Secure the API Gateway REST API with AWS_IAM authorization, and configure the client to sign requests using temporary credentials obtained from the Identity Pool.Answer
  4. D
    Configure an Amazon Cognito User Pool federated with the SAML IdP. Secure the API Gateway REST API using a custom Lambda Authorizer. Configure the Lambda Authorizer to receive the Cognito ID token, call the Cognito IDP GetUser API on every request to verify the token signature, and extract the group attributes to generate the IAM policy.

Answer

Configure an Amazon Cognito User Pool federated with the SAML IdP, mapping group claims to Cognito groups. Set up an Amazon Cognito Identity Pool with the User Pool as the provider, configured to resolve the IAM role from the user's token. Secure the API Gateway REST API with AWS_IAM authorization, and configure the client to sign requests using temporary credentials obtained from the Identity Pool.
The correct solution leverages Cognito User Pools for federating the SAML IdP and mapping group claims, and uses Cognito Identity Pools to assign distinct IAM roles based on those groups. By securing API Gateway with AWS_IAM, the mobile client signs requests using SigV4 credentials, allowing API Gateway to perform native IAM evaluation without invoking a custom Lambda function. This approach satisfies both the S3 upload requirement and the low-latency API authorization requirement while adhering to least-privilege principles.

Step-by-Step Solution

1
Authenticate users via the Amazon Cognito User Pool federated with the corporate SAML IdP.
The user is authenticated and the mobile client receives a Cognito User Pool ID token containing SAML group attributes mapped to Cognito groups.
Allows integration with the corporate identity store while standardizing identity tokens.
2
Exchange the ID token for temporary AWS credentials using the Cognito Identity Pool.
The Identity Pool evaluates the user's group to the corresponding IAM role (such as Finance or Engineering) based on token claims and returns temporary credentials.
Enables fine-grained AWS role mapping and authorizes direct S3 bucket folder uploads using the identity ID context.
3
Secure the API Gateway REST API with AWS_IAM authorization and configure the client to sign API requests.
API Gateway natively evaluates the permissions policy attached to the caller's assumed IAM role without calling custom authorization code.
Provides low-latency, zero-custom-code authorization at the gateway layer.

Key Concept

Integrating Amazon Cognito User Pools, Cognito Identity Pools, and AWS IAM to achieve secure role-based access control and fine-grained authorization for S3 and API Gateway.
Estimated Time:3m 0s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic