Examkin

Question

Difficulty: EasyAmazon Cognito Authentication and Authorization

A developer is building a mobile game that needs to save user progress data directly to an Amazon DynamoDB table. Users must first authenticate, and the application must then obtain temporary, limited-privilege AWS credentials to authorize write operations to the DynamoDB table. Which Amazon Cognito feature should the developer use to obtain these temporary AWS credentials?

  1. Cognito Identity PoolsAnswer
  2. B
    Cognito User Pools
  3. C
    Cognito User Pools combined with an API Gateway Lambda Authorizer
  4. D
    Cognito User Pools using hardcoded IAM Access Keys

Answer

Cognito Identity Pools
Cognito Identity Pools (Federated Identities) are specifically designed to authorize users by exchanging authentication tokens (from Cognito User Pools or social providers) for temporary, limited-privilege AWS credentials. This allows mobile applications to call AWS services directly, such as writing to DynamoDB, using the permissions defined in the assumed IAM role.

Step-by-Step Solution

1
Identify the authentication and authorization requirements.
The application requires authentication to verify identity, and then authorization using temporary AWS credentials to write directly to DynamoDB.
Determining whether the client needs direct AWS resource access versus REST API access helps select the correct Cognito feature.
2
Differentiate between User Pools and Identity Pools.
Cognito User Pools provide user directories and authentication (JWTs). Cognito Identity Pools provide authorization by exchanging authentication tokens for temporary AWS credentials.
Selecting the feature that specifically generates temporary credentials ensures secure, direct SDK access to AWS services.

Key Concept

Amazon Cognito Identity Pools vs User Pools for AWS resource access
Estimated Time:45s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic