Examkin

Question

Difficulty: HardAmazon Cognito Authentication and Authorization

A developer is designing a mobile multiplayer game. The game client needs to read and write player progress data directly to an Amazon DynamoDB table without routing requests through a custom backend API, to minimize latency and server costs. Players must authenticate using an Amazon Cognito User Pool. The security design requires that players can only access DynamoDB items where the partition key matches their unique Cognito user identifier. Which solution meets these requirements with the least operational overhead?

  1. A
    Configure a Amazon Cognito User Pool with a Post-Authentication AWS Lambda trigger. Have the Lambda function call the AWS Security Token Service (STS) to assume an IAM role with DynamoDB access, and inject these temporary credentials into the Cognito ID token claims returned to the mobile client.
  2. Configure an Amazon Cognito Identity Pool and set the Amazon Cognito User Pool as the authentication provider. Associate an IAM role with the authenticated users that permits DynamoDB access, using the dynamodb:LeadingKeys condition key set to ${cognito-identity.amazonaws.com:sub} in the IAM policy.Answer
  3. C
    Configure an Amazon API Gateway REST API with a Cognito User Pool Authorizer to proxy DynamoDB requests. Secure the DynamoDB table using an IAM resource policy that restricts access based on the cognito:username claim passed in the API Gateway request context.
  4. D
    Create a Cognito User Pool and assign an IAM role directly to a User Pool group. Have the mobile client authenticate against the User Pool and use the User Pool ID token directly to initialize the DynamoDB client, which automatically restricts access based on the group role.

Answer

Configure an Amazon Cognito Identity Pool, configure the User Pool as the identity provider, and apply an IAM policy with a dynamodb:LeadingKeys condition using the Cognito Identity ID.
To access AWS resources directly from a client application using the AWS SDK, the client must obtain temporary AWS credentials. Amazon Cognito Identity Pools (federated identities) are designed for this purpose. They authenticate users via an identity provider (such as an Amazon Cognito User Pool) and exchange the resulting token for temporary AWS credentials associated with an IAM role. Fine-grained access control to DynamoDB is achieved by attaching a policy to the IAM role that uses the dynamodb:LeadingKeys condition key set to the special AWS variable ${cognito-identity.amazonaws.com:sub}, which represents the user's unique Cognito Identity ID.

Step-by-Step Solution

1
Identify the authentication and authorization flow required for direct AWS SDK access from the mobile client.
Recognize that while Cognito User Pools handle user directory and authentication (generating JWT tokens), they do not vend temporary AWS credentials needed by the AWS SDK to sign DynamoDB requests. An Amazon Cognito Identity Pool (federated identities) is required to exchange the User Pool JWT for temporary AWS credentials.
This establishes the identity federation pipeline to obtain valid AWS credentials directly on the client.
2
Configure the Cognito Identity Pool authentication provider.
Link the Cognito User Pool as the authentication provider in the Identity Pool configuration.
This allows the Identity Pool to trust tokens issued by the User Pool and assign an authenticated IAM role to the users.
3
Implement fine-grained access control on the DynamoDB table using IAM policies.
Create an IAM policy for the authenticated user role that grants access to DynamoDB, utilizing the dynamodb:LeadingKeys condition key set to the user's unique Cognito Identity ID: ${cognito-identity.amazonaws.com:sub}.
This dynamically limits the player's access to only the DynamoDB items where the partition key value matches their authenticated Cognito Identity ID, fulfilling the security requirement.

Key Concept

Cognito Identity Pools handle authorization by exchanging authentication tokens for temporary AWS credentials, enabling fine-grained access control to AWS resources via IAM policy variables.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic