Examkin

Question

Difficulty: HardApplication Authentication and Authorization with Amazon Cognito

A company is developing a serverless web application where users authenticate via a third-party SAML Identity Provider (IdP) integrated with an Amazon Cognito User Pool. Upon successful login, the frontend application receives Cognito JSON Web Tokens (JWTs). The frontend needs to call a backend REST API hosted on Amazon API Gateway, which triggers an AWS Lambda function. The Lambda function must retrieve the user's custom database tenant ID (mapped from the SAML assertion to a Cognito custom attribute) to perform tenant-isolated database queries. The solution must minimize code complexity and avoid custom token verification logic in the Lambda function.

Which combination of steps should the developer perform to meet these requirements? (Select TWO.)

  1. Configure a built-in Cognito User Pool Authorizer on the API Gateway REST API methods and pass the Cognito ID token in the Authorization header of the request.Answer
  2. Access the user's custom attribute in the backend Lambda function using the event.requestContext.authorizer.claims['custom:tenant_id'] context path.Answer
  3. C
    Configure a custom Lambda Authorizer in API Gateway that validates the token signature and calls the Cognito IDP AdminGetUser API to fetch user attributes.
  4. D
    Establish an Amazon Cognito Identity Pool to map the SAML federated users to IAM roles, and configure API Gateway to use IAM Authorization.
  5. E
    Configure an IAM role with a trust policy that allows Amazon Cognito User Pools to assume the role, then pass this role ARN in the API request header.

Answer

Configure a built-in Cognito User Pool Authorizer on the API Gateway methods to validate the ID token, and retrieve the custom mapped attribute inside the Lambda function using the requestContext authorizer claims context.
The correct approach involves using the built-in Cognito User Pool Authorizer on API Gateway. This validates incoming ID tokens and passes the claims directly to the Lambda function. Inside the Lambda function, the mapped custom attribute can be extracted from the requestContext authorizer claims without calling Cognito APIs or writing custom validation logic.

Step-by-Step Solution

1
Integrate the SAML IdP with Amazon Cognito User Pools, mapping the SAML assertion fields to Cognito custom attributes (such as custom:tenant_id).
Upon user authentication, Cognito issues an ID token containing the user claims and custom attributes.
This establishes user identity and maps the required business context into the standard token format.
2
Create and configure a built-in Cognito User Pool Authorizer in API Gateway, linking it to the Cognito User Pool, and apply it to the API Gateway methods.
API Gateway automatically intercepts requests, validates the token signature, checks expiration, and retrieves user claims.
This offloads token validation complexity from the application code.
3
In the backend Lambda function code, read the custom attributes from the incoming event structure context.
The Lambda function receives the claims directly under the requestContext object, permitting the function to isolate data access using the tenant ID without performing any cryptographic operations or SDK calls.
This matches the requirement to minimize code complexity and avoid custom verification logic.

Key Concept

API Gateway Cognito Authorizers parse and validate Cognito JSON Web Tokens (JWTs) automatically, exposing the decoded claims directly to integrated backend Lambda functions via the request context.
Estimated Time:2m 0s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic