Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is building a web-based reporting dashboard for an enterprise sales team. Users of the dashboard must authenticate using their email and password. Once authenticated, the client application needs to perform two actions: call a secure REST API hosted on Amazon API Gateway to fetch sales metadata, and download raw report files directly from a private Amazon S3 bucket. The developer wants to use Amazon Cognito to implement the authentication and authorization flows. Which TWO configuration steps should the developer perform to meet these requirements with the least administrative and operational overhead? (Select TWO.)

  1. Set up an Amazon Cognito User Pool to manage user registration and authentication, and configure a Cognito User Pool Authorizer on Amazon API Gateway to secure the REST API.Answer
  2. Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider for it, and map an IAM role with read permissions for the private S3 bucket to authenticated users.Answer
  3. C
    Create a custom API Gateway Lambda Authorizer to decode and validate the JSON Web Tokens (JWT) issued by the Cognito User Pool for each REST API request.
  4. D
    Configure the API Gateway REST API to use AWS IAM authorization, and configure the client application to pass the Cognito User Pool access token directly in the HTTP Authorization header.
  5. E
    Configure the Amazon Cognito User Pool to generate temporary AWS credentials for authenticated users and attach an IAM policy directly to the User Pool to allow S3 access.

Answer

The developer should set up a Cognito User Pool to manage user registration and login, and secure the API Gateway REST API using the native Cognito User Pool Authorizer. Additionally, the developer should create a Cognito Identity Pool linked to the User Pool to grant temporary AWS credentials for S3 bucket access via an authenticated IAM role.
To authenticate users and secure API Gateway REST APIs with the least overhead, a developer should use an Amazon Cognito User Pool combined with API Gateway's native Cognito User Pool Authorizer. To authorize users to download files directly from Amazon S3, the developer must exchange the Cognito User Pool identity tokens for temporary AWS credentials using a Cognito Identity Pool, which maps users to an IAM role with read permissions for the target S3 bucket.

Step-by-Step Solution

1
Configure the authentication directory and API security.
An Amazon Cognito User Pool is configured to manage user sign-in and sign-up. The API Gateway REST API is protected by selecting Cognito User Pool Authorizer, which natively parses and validates the client's token.
This establishes user identity and protects the REST API with the lowest operational complexity.
2
Configure AWS resource authorization.
An Amazon Cognito Identity Pool is created with the Cognito User Pool configured as an identity provider. An IAM role containing read permissions for the target S3 bucket is attached to the Identity Pool's authenticated role.
This allows authenticated users to obtain temporary AWS credentials for direct, secure interaction with the S3 bucket.

Key Concept

Amazon Cognito User Pools provide authentication and user directories, integrating natively with API Gateway via Cognito Authorizers. Cognito Identity Pools handle authorization by exchanging user identity tokens for temporary AWS credentials to access AWS services directly.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic