Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A developer is implementing user authentication for a web application. The application must allow users to register and sign in directly using their email addresses. Once signed in, the client application needs to invoke a secured REST API hosted on Amazon API Gateway. The developer wants to validate user sessions at the API Gateway layer while minimizing operational overhead and avoiding custom token-validation code.

Which configuration should the developer implement to meet these requirements?

  1. A
    Use an Amazon Cognito Identity Pool to manage user registration and authentication. Create a Cognito Authorizer on the API Gateway REST API to validate the credentials.
  2. Use an Amazon Cognito User Pool to manage user registration and authentication. Configure a Cognito User Pool Authorizer on the API Gateway REST API and pass the ID token in the authorization header of the requests.Answer
  3. C
    Use an Amazon Cognito User Pool to manage user registration and authentication. Create a custom API Gateway Lambda Authorizer that parses the user pool token, downloads the JSON Web Key Set (JWKS), and manually validates the signature.
  4. D
    Use an Amazon Cognito Identity Pool to authenticate users. Configure a custom Lambda Authorizer on API Gateway that assumes the authenticated IAM role by configuring the IAM role's trust policy to trust the API Gateway service principal.

Answer

Use an Amazon Cognito User Pool to manage user registration and authentication, configure a Cognito User Pool Authorizer on the API Gateway REST API, and pass the ID token in the authorization header of the requests.
The correct configuration uses an Amazon Cognito User Pool because it manages the user directory, sign-up, and sign-in, returning standard JSON Web Tokens (JWTs). Configuring a built-in Cognito User Pool Authorizer on the API Gateway REST API allows API Gateway to natively inspect the authorization header and validate the Cognito ID token without custom-written validation logic.

Step-by-Step Solution

1
Select User Directory Service
Choose Amazon Cognito User Pool to handle registration, password management, and user sign-in directly.
Cognito User Pools provide a built-in user directory, whereas Cognito Identity Pools are used for federating identity to obtain temporary AWS credentials.
2
Configure API Gateway Authorizer
Create a built-in Cognito User Pool Authorizer on the REST API resources in API Gateway, pointing it to the created Cognito User Pool.
This offloads token verification (signature, expiration, claims) entirely to API Gateway without writing custom Lambda authorizer code.
3
Transmit Session Token from Client
Send the identity token (ID Token) received after successful Cognito authentication in the request's Authorization header.
The Cognito User Pool Authorizer extracts and validates this token from the configured header to allow or deny the API invocation.

Key Concept

API Gateway integration with Amazon Cognito User Pools for standard authentication flows
Estimated Time:1m 30s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic