Examkin

Question

Difficulty: HardAmazon Cognito Authentication and Authorization

A developer is designing a web application hosted on Amazon ECS behind an Application Load Balancer (ALB). The application requires users to authenticate via an Amazon Cognito User Pool. The ALB must authenticate incoming HTTP requests and forward the verified user identity claims to the backend ECS containers without requiring token validation logic inside the container code. Additionally, authenticated users must be able to upload profile images directly from their web client to their own folder within an Amazon S3 bucket. Which TWO configurations must the developer implement to meet these requirements?

  1. Add an authenticate action using Cognito to the Application Load Balancer listener rule, which verifies the user session and forwards user claims to the target group in the x-amzn-oidc-data header.Answer
  2. Configure a Cognito Identity Pool using the User Pool as an identity provider, and attach an IAM policy to the authenticated role that grants permission to upload to the resource path arn:aws:s3:::my-bucket/uploads/${cognito-identity.amazonaws.com:sub}/*.Answer
  3. C
    Create an Amazon API Gateway Cognito Authorizer and associate it with the Application Load Balancer listener to authenticate incoming HTTP requests and populate the container headers.
  4. D
    Enable Cognito User Pool Hosted UI on the client, and configure the client to use the User Pool JSON Web Token (JWT) directly as the AWS Access Key and Secret Key to authenticate S3 PutObject calls.
  5. E
    Configure the Cognito User Pool to automatically assume an IAM role for each authenticated session and return temporary credentials directly in the ID token for S3 uploads.

Answer

To meet the requirements, the developer must configure an authenticate action using Cognito on the Application Load Balancer listener rule and set up a Cognito Identity Pool with the User Pool as an identity provider, associating it with an IAM policy that allows access to the user-specific S3 folder path using the identity sub variable.
To offload authentication, the Application Load Balancer listener rule must be configured with an authenticate action using Cognito. The ALB then verifies the tokens and forwards the user information to backend targets via the x-amzn-oidc-data header. For S3 access, the client requires temporary AWS credentials, which are obtained by creating a Cognito Identity Pool that uses the User Pool as an identity provider. The IAM policy attached to the authenticated role uses the ${cognito-identity.amazonaws.com:sub} policy variable to dynamically restrict access to the folder matching the user's Cognito identity ID.

Step-by-Step Solution

1
Identify that the Application Load Balancer needs to offload authentication.
Recognize that ALB supports a native integration with Cognito User Pools using listener rules with an authenticate action.
This avoids having to write custom token validation logic inside the ECS container application code.
2
Determine how the Application Load Balancer passes user identities.
The ALB passes user claims to the targets in HTTP headers such as x-amzn-oidc-data.
This allows the backend application to read claims such as the user ID or email without performing JWT signature checks.
3
Determine how the client can directly upload to S3.
Configure a Cognito Identity Pool to exchange the user pool tokens for temporary credentials.
Since S3 requires AWS IAM credentials and does not natively accept Cognito User Pool tokens, a Cognito Identity Pool must act as the credential provider.
4
Secure the S3 upload path using a policy variable.
Apply an IAM policy to the authenticated role that references ${cognito-identity.amazonaws.com:sub} to restrict each user to their own upload folder.
This dynamically resolves to the Cognito Identity ID of the authenticated user, achieving fine-grained access control.

Key Concept

Integrating Application Load Balancers with Cognito User Pools for authentication and using Cognito Identity Pools for temporary AWS credentials to access S3.
Estimated Time:2m 30s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic