An organization is developing a web-based document portal using React. The portal must allow employees to authenticate using their existing corporate SAML identity provider (IdP). Once authenticated, the application must meet the following requirements:
1. Access a backend REST API hosted on Amazon API Gateway, validating the user's authentication token and verifying their group membership.
2. Directly download department-specific files from an Amazon S3 bucket, restricting access so that users can only retrieve objects under a prefix that matches their department attribute (e.g., /finance/* for the finance department).
Which combination of configuration steps will meet these requirements with the least operational overhead and the most secure architecture?
- AConfigure an Amazon Cognito Identity Pool to federate directly with the SAML IdP to handle user authentication. Use an API Gateway Lambda Authorizer to validate the Identity Pool's credentials for API access. Set up an Amazon Cognito User Pool to generate temporary AWS credentials for the web application, and apply an IAM policy to the User Pool's authenticated role that grants access to the S3 bucket using the user's department attribute.
- BConfigure an Amazon Cognito User Pool federated with the SAML IdP. Write a custom API Gateway Lambda Authorizer to manually decode, verify, and extract claims from the Cognito ID token. Configure a Cognito Identity Pool to obtain temporary AWS credentials, and write an IAM policy for the authenticated role that references the custom department attribute directly as a policy variable without setting up attribute mappings or session tags.
- CConfigure an Amazon Cognito User Pool federated with the SAML IdP. Use a Cognito User Pool Authorizer on API Gateway to validate the ID token. Set up a Cognito Identity Pool that maps the user's department attribute to the principal tag department. Associate an IAM role with the Identity Pool, but omit the sts:TagSession action from the trust policy, and write an IAM permission policy for the role referencing the department tag in the S3 resource path.
- Configure an Amazon Cognito User Pool federated with the SAML IdP. Use a Cognito User Pool Authorizer on API Gateway to validate the ID token. Set up a Cognito Identity Pool that uses the User Pool as an identity provider, and map the user's department attribute to the principal tag department. Associate an IAM role with the Identity Pool, ensuring its trust policy allows sts:AssumeRoleWithWebIdentity and sts:TagSession, and apply an S3 permission policy referencing the department tag in the resource path.Answer
Answer
The correct option is the one that configures a Cognito User Pool federated with the SAML IdP, uses a Cognito User Pool Authorizer on API Gateway, maps the department attribute to a principal tag in the Identity Pool, and includes both sts:AssumeRoleWithWebIdentity and sts:TagSession in the IAM role's trust policy.
The correct solution uses an Amazon Cognito User Pool to handle user authentication and federation with the corporate SAML IdP. The REST API hosted on API Gateway is secured using a built-in Cognito User Pool Authorizer, which handles token verification natively without custom code. To obtain temporary AWS credentials for S3 access, a Cognito Identity Pool is utilized. By configuring 'Attributes for access control' in the Identity Pool, the custom department claim from the user's token is mapped to a principal tag named department. The trust policy of the IAM role assumed by authenticated users must allow sts:AssumeRoleWithWebIdentity and sts:TagSession to permit Cognito to apply this tag to the session. The S3 permissions policy can then dynamically restrict access to department-specific prefixes by referencing the policy variable ${aws:PrincipalTag/department}.
Step-by-Step Solution
Key Concept
Attribute-Based Access Control (ABAC) using Cognito User Pools and Identity Pools with session tags