Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is implementing a mobile e-commerce application. The application requires a secure user sign-up and sign-in system. Once authenticated, the application must make secure REST API requests to an Amazon API Gateway backend to fetch order history. The developer wants to use a managed user directory and ensure that API Gateway automatically validates the JSON Web Tokens (JWT) sent in the request header without maintaining custom authentication code or custom backend validation logic.

Which setup meets these requirements with the lowest operational complexity?

  1. Use an Amazon Cognito User Pool to handle user registration and sign-in. Configure a Cognito User Pool Authorizer on the API Gateway REST API method to validate the ID or access token sent by the mobile application.Answer
  2. B
    Use an Amazon Cognito Identity Pool to handle user registration and sign-in. Configure a Cognito Authorizer on the API Gateway REST API method to validate the identity pool tokens directly.
  3. C
    Use an Amazon Cognito User Pool to handle user registration and sign-in. Create a custom API Gateway Lambda authorizer that retrieves the public JSON Web Key Set (JWKS) from Cognito to verify the signature and validity of the incoming JWT for each request.
  4. D
    Store the user accounts in a backend database. Hardcode an IAM user's AWS access key and secret key within the mobile application's source code, using the AWS SDK to sign each HTTP request before sending it to the API Gateway.

Answer

Use an Amazon Cognito User Pool to handle user registration and sign-in. Configure a Cognito User Pool Authorizer on the API Gateway REST API method to validate the ID or access token sent by the mobile application.
The correct option is to use an Amazon Cognito User Pool to manage sign-in and sign-up, and configure a Cognito User Pool Authorizer on API Gateway. Cognito User Pools natively handle the user directory and issue JWTs (ID/access tokens) upon authentication. API Gateway's built-in Cognito Authorizer directly validates these JWTs without requiring custom Lambda code, which reduces development effort and operational overhead.

Step-by-Step Solution

1
Determine the service needed for user directory management, registration, and sign-in.
Identify Amazon Cognito User Pools as the service that manages user directories and issues JSON Web Tokens (JWTs) upon successful authentication.
Cognito User Pools serve as the identity provider (IdP) for user management, whereas Identity Pools are used for exchanging tokens for AWS credentials.
2
Evaluate the method for securing the API Gateway REST API using these Cognito tokens without writing custom validation code.
Select the built-in Cognito User Pool Authorizer in API Gateway.
The Cognito User Pool Authorizer natively integrates with API Gateway, extracting and validating the JWT from the request headers automatically, thus eliminating the need for a custom Lambda authorizer.

Key Concept

Amazon Cognito User Pools provide authentication and token issuance, which can be natively validated at API Gateway using a built-in Cognito User Pool Authorizer to secure API endpoints with minimal operational overhead.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic