Examkin

Question

Difficulty: HardApplication Authentication and Authorization with Amazon Cognito

A developer is implementing a secure authentication and authorization mechanism for a web-based client portal. The portal consists of a React single-page application (SPA) and an Amazon API Gateway REST API backed by AWS Lambda. The developer must allow users to sign in, retrieve their profile details, and enforce group-based access control (e.g., Administrators vs. Standard Users) on the API Gateway endpoints. The architecture must minimize latency, avoid unnecessary external API calls during request processing, and leverage built-in AWS integrations where possible.

Which TWO actions should the developer take to meet these requirements?

  1. Configure a Cognito User Pool to manage user identities, and associate a Cognito User Pools authorizer with the API Gateway REST API.Answer
  2. Configure the API Gateway integration to forward token claims, and inspect the cognito:groups claim within the Lambda request context to determine user permissions.Answer
  3. C
    Create a Cognito Identity Pool to obtain temporary AWS credentials for authenticated users, and configure API Gateway to use AWS_IAM authorization with a custom Lambda authorizer to validate the signature.
  4. D
    Configure a custom Lambda authorizer on API Gateway to perform manual token signature validation, and call the AdminListGroupsForUser API inside the Lambda authorizer to fetch user groups.
  5. E
    Define an IAM role trust policy that allows the API Gateway execution role to assume Cognito Identity Pool roles, and map user groups to IAM policies directly through the API Gateway execution role.

Answer

To implement the authentication and authorization flow, configure a Cognito User Pool with a Cognito User Pools authorizer on the API Gateway REST API. Then, check user groups in the backend Lambda function by inspecting the cognito:groups claim inside the request context.
The correct approach is to use a Cognito User Pool combined with a Cognito User Pools authorizer on API Gateway, and to inspect the cognito:groups claim inside the backend Lambda function. The Cognito User Pool serves as the user directory and generates JWT tokens. API Gateway's built-in Cognito authorizer natively validates these tokens, reducing latency. After validation, API Gateway forwards the token claims (including the user's groups in the cognito:groups claim) directly to the Lambda request context, enabling authorization checks without any additional Cognito API calls.

Step-by-Step Solution

1
Select Cognito User Pools for authentication.
Cognito User Pools authenticate users, issue JWTs (ID and access tokens), and support social or enterprise identity providers.
The scenario requires user sign-in and identity management, which is the primary function of Cognito User Pools.
2
Integrate API Gateway with the Cognito User Pool.
API Gateway automatically validates the signature and expiration of incoming tokens using a native Cognito User Pools authorizer.
This offloads token verification logic from custom backend code, reducing latency and operational overhead.
3
Inspect token claims in the Lambda function for authorization.
The Lambda function receives claims (including the cognito:groups list) under the event.requestContext.authorizer.claims structure.
Accessing claims via the request context avoids executing slow and costly SDK calls to Cognito APIs to verify group membership.

Key Concept

Using Cognito User Pools with native API Gateway authorizers to authenticate users and forwarding claims to AWS Lambda for group-based authorization.
Estimated Time:2m 0s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic