Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is implementing a smart home mobile application. The mobile client needs to authenticate users and obtain temporary, limited-privilege AWS credentials to publish telemetry data directly to Amazon IoT Core MQTT topics.

Which solution meets these requirements with the least operational overhead?

  1. A
    Authenticate users using an Amazon Cognito User Pool. Use the Cognito User Pool ID token directly to authorize the mobile client to publish messages to AWS IoT Core.
  2. Authenticate users using an Amazon Cognito User Pool. Configure an Amazon Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials associated with an IAM role that permits publishing to AWS IoT Core.Answer
  3. C
    Authenticate users using an Amazon Cognito User Pool. Deploy an Amazon API Gateway endpoint with a custom Lambda Authorizer that validates the Cognito tokens and calls AWS STS to return temporary AWS credentials.
  4. D
    Authenticate users using an Amazon Cognito User Pool. Embed a long-lived IAM User access key and secret access key in the mobile application configuration to perform AWS IoT Core publish operations.

Answer

Authenticate users using an Amazon Cognito User Pool. Configure an Amazon Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials associated with an IAM role that permits publishing to AWS IoT Core.
Using an Amazon Cognito User Pool for user authentication combined with an Amazon Cognito Identity Pool to exchange tokens for temporary AWS credentials is the standard, built-in AWS pattern. The Identity Pool handles the generation of temporary credentials via an IAM role with minimum operational overhead.

Step-by-Step Solution

1
Use Amazon Cognito User Pools for user sign-up and sign-in management.
Users are authenticated, and the mobile client receives JSON Web Tokens (JWTs).
Cognito User Pools serve as the identity provider to verify user identities.
2
Configure an Amazon Cognito Identity Pool and associate it with the Cognito User Pool as an authentication provider.
The client application can present the User Pool tokens to the Identity Pool in exchange for temporary AWS credentials.
Cognito Identity Pools provide authorization to AWS resources by vending temporary AWS credentials.
3
Assign an IAM role with permissions to publish to AWS IoT Core MQTT topics to the authenticated user role in the Identity Pool.
The mobile client uses the obtained temporary credentials to interact securely and directly with AWS IoT Core.
This implements the principle of least privilege using short-lived credentials, minimizing security risks and administrative overhead.

Key Concept

Amazon Cognito User Pools handle authentication (user directory and tokens), whereas Cognito Identity Pools handle authorization by exchanging those tokens for temporary AWS credentials.
Estimated Time:1m 30s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic