Examkin

Question

Difficulty: MediumResolving IAM and Authorization Failures

A developer is implementing fine-grained access control for a mobile application. Users authenticate via an Amazon Cognito User Pool, and the application needs to write user-specific profile data to an Amazon DynamoDB table named `UserProfiles`. The table's partition key is `UserId` (String). The developer created an Amazon Cognito Identity Pool to provide temporary AWS credentials to authenticated users and attached an IAM policy to the authenticated role that uses the `dynamodb:LeadingKeys` condition. However, when the application attempts to write data to the DynamoDB table, the API calls fail with an `AccessDeniedException` error. Which two actions must the developer take to resolve these authorization failures?

  1. Configure the application to exchange the Cognito User Pool tokens for temporary AWS credentials from the Cognito Identity Pool, and use these credentials to sign the DynamoDB requests.Answer
  2. Ensure that the partition key `UserId` value in the DynamoDB write request is set to the user's Cognito Identity ID.Answer
  3. C
    Modify the trust policy of the authenticated IAM role to restrict the `dynamodb:LeadingKeys` condition to the Cognito identity provider.
  4. D
    Associate the IAM permission policy allowing `dynamodb:PutItem` directly to the Cognito User Pool's App Client configuration.
  5. E
    Embed static IAM credentials directly into the application's SDK client configuration to bypass the Cognito Identity Pool exchange.

Answer

To resolve the authorization failures, the application must exchange the Cognito User Pool tokens for temporary AWS credentials from the Cognito Identity Pool and use those credentials to sign the requests. Additionally, the partition key value in the DynamoDB write request must match the user's Cognito Identity ID.
To resolve the authorization failure, the developer must ensure that the mobile application properly coordinates authentication and authorization. First, the application must exchange the Cognito User Pool token for temporary AWS credentials using the Cognito Identity Pool, as the User Pool token alone does not grant direct AWS service access. Second, the write request to DynamoDB must use the user's Cognito Identity ID as the partition key value to satisfy the `dynamodb:LeadingKeys` condition in the IAM permissions policy.

Step-by-Step Solution

1
Acquire temporary AWS credentials
The application authenticates against the Cognito User Pool, obtains an ID token, passes it to the Cognito Identity Pool using the `GetCredentialsForIdentity` API, and receives temporary AWS credentials associated with the authenticated IAM role.
DynamoDB requests must be signed with AWS credentials that map to the authorized IAM role, which is managed by the Identity Pool rather than the User Pool.
2
Align request partition key with IAM policy condition
The application sets the `UserId` partition key attribute of the write payload to the user's unique Cognito Identity ID.
The IAM policy uses `dynamodb:LeadingKeys` with `${cognito-identity.amazonaws.com:sub}`, meaning DynamoDB will reject any write request where the partition key does not match the requester's Cognito Identity ID.

Key Concept

Using Amazon Cognito Identity Pools and DynamoDB Fine-Grained Access Control (FGAC) to securely authorize mobile applications to access AWS services.
Estimated Time:1m 30s
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic