Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

An IoT startup is developing a dashboard web application that allows users to authenticate using external social providers (Google and Apple) via Amazon Cognito. Once authenticated, the web application must interact with two backend systems:
1. Make authenticated requests to an Amazon API Gateway HTTP API that manages dashboard configurations.
2. Directly publish sensor telemetry data to an Amazon Kinesis Data Stream.

Which TWO configurations must the developer implement to secure access to these resources? (Select TWO.)

  1. Configure an Amazon Cognito User Pool federated with Google and Apple, and set up an Amazon API Gateway JWT authorizer that validates the identity tokens issued by the User Pool.Answer
  2. Configure an Amazon Cognito Identity Pool that integrates with the User Pool as an identity provider, and associate an IAM role with the authenticated identities that grants kinesis:PutRecord permissions.Answer
  3. C
    Configure an Amazon Cognito User Pool federated with Google and Apple, and set up the User Pool to directly issue temporary AWS security credentials to the client application for publishing to the Kinesis Data Stream.
  4. D
    Create a custom Lambda Authorizer in Amazon API Gateway that intercepts requests, extracts the User Pool access token, and calls the Cognito GetUser API to validate the token signature.
  5. E
    Use Amazon Cognito Identity Pools to authorize requests to the API Gateway HTTP API by passing the Identity Pool ID in the Authorization header of the HTTP requests.

Answer

To secure the HTTP API, configure a User Pool federated with Google and Apple and use an API Gateway JWT authorizer. To authorize direct Kinesis writes, configure an Identity Pool that exchanges User Pool tokens for temporary AWS credentials with the required IAM policy.
Setting up a Cognito User Pool with Google and Apple federation allows the application to authenticate users and receive JSON Web Tokens (JWTs). These JWTs can be natively validated by an API Gateway HTTP API JWT authorizer. An Identity Pool takes the token from the authenticated User Pool session and exchanges it for temporary AWS credentials via an IAM role, which allows the application to directly call the Kinesis API.

Step-by-Step Solution

1
Determine how to authenticate users via Google and Apple and secure API Gateway HTTP API routes.
Identify that an Amazon Cognito User Pool acts as the user directory and identity provider (IdP), and that API Gateway HTTP APIs can use a native JWT authorizer to validate the issued token.
User Pools handle authentication and federation with social providers, while API Gateway JWT authorizers offer low-latency, built-in validation of these user pool tokens.
2
Determine how the client application can write to the Amazon Kinesis Data Stream directly.
Identify that the client needs temporary AWS credentials authorized via an IAM role to call the Kinesis API.
Cognito Identity Pools exchange Cognito User Pool tokens for temporary AWS security credentials, enabling direct, secure client access to AWS resources like Kinesis.
3
Associate the IAM role with the correct Cognito construct.
Configure the Cognito Identity Pool with the authenticated IAM role containing the kinesis:PutRecord policy.
This maps authenticated users to the specific AWS IAM policy required to publish telemetry data to Kinesis.

Key Concept

Distinguishing and integrating Amazon Cognito User Pools for user authentication and Identity Pools for AWS resource authorization.
Estimated Time:2m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic