Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is migrating a legacy desktop application to a modern cloud-native web application. The application must support federated single sign-on (SSO) using a corporate SAML identity provider. Once users log in, the web client needs to access a private Amazon S3 bucket to retrieve user-specific reports and call a secured Amazon API Gateway HTTP API. Which TWO configurations must the developer implement to meet these requirements with the least operational overhead?

  1. Configure an Amazon Cognito User Pool with a SAML identity provider integration, and configure the API Gateway HTTP API to use a JWT authorizer that validates the User Pool tokens.Answer
  2. Configure an Amazon Cognito Identity Pool that trusts the User Pool, and associate the authenticated IAM role with permissions to read from the target S3 bucket.Answer
  3. C
    Configure the S3 bucket policy to trust the Cognito User Pool directly, allowing access based on the User Pool ID token.
  4. D
    Implement a custom AWS Lambda authorizer in API Gateway to validate the Cognito tokens and generate dynamic IAM policies for S3 access.
  5. E
    Configure the Cognito User Pool to issue temporary AWS credentials directly to the client application via the AWS SDK.

Answer

Configure an Amazon Cognito User Pool with a SAML identity provider integration, configure the API Gateway HTTP API to use a JWT authorizer that validates the User Pool tokens, and configure an Amazon Cognito Identity Pool that trusts the User Pool, associating the authenticated IAM role with permissions to read from the target S3 bucket.
To meet the requirements with the least operational overhead, the developer should combine Amazon Cognito User Pools and Identity Pools. The User Pool handles authentication, integrating with the SAML identity provider to authenticate users. For API Gateway HTTP APIs, the built-in JWT authorizer validates the User Pool tokens without requiring custom code. To access Amazon S3, the developer needs an Identity Pool to exchange the authenticated User Pool token for temporary AWS credentials, allowing the web client to perform direct S3 API requests using an IAM role.

Step-by-Step Solution

1
Configure user authentication and identity federation.
Create an Amazon Cognito User Pool, integrate it with the corporate SAML identity provider, and configure the application to redirect users for login.
This establishes the identity directory and federated identity management with the external SAML provider.
2
Implement API Gateway authorization.
Configure a native JWT authorizer on the API Gateway HTTP API pointing to the Cognito User Pool issuer URL.
This secures the HTTP API endpoints by validating the JSON Web Tokens (JWT) issued by Cognito, requiring zero custom Lambda code.
3
Enable secure S3 access.
Create an Amazon Cognito Identity Pool, configure the User Pool as an identity provider, and attach an IAM policy to the authenticated role allowing read permissions to the S3 bucket.
This enables the web client to exchange its Cognito User Pool token for temporary AWS credentials to read reports directly from Amazon S3.

Key Concept

Combining Cognito User Pools for user authentication and API Gateway token validation with Cognito Identity Pools for temporary AWS credential authorization.
Estimated Time:2m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic