Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A developer is building a web dashboard that allows corporate employees to sign in using their existing third-party SAML Identity Provider (IdP). The application must access a secure REST API hosted on Amazon API Gateway. The developer wants to validate the user's session at the API Gateway layer using a built-in integration and extract the user's profile claims in the backend AWS Lambda function without writing custom token validation code.

Which configuration strategy should the developer implement to meet these requirements with the least development effort?

  1. A
    Configure an Amazon Cognito Identity Pool federated with the SAML IdP. Use API Gateway IAM authorization, sign the API requests using the temporary AWS credentials, and decode the credentials in the Lambda function to extract user claims.
  2. B
    Configure an Amazon Cognito User Pool federated with the SAML IdP. Create an API Gateway Lambda Authorizer that intercepts the SAML response, decodes the token, validates the signature, and injects the claims into the context.
  3. Configure an Amazon Cognito User Pool federated with the SAML IdP. Create a Cognito User Pool Authorizer in API Gateway and pass the Cognito ID token in the request header to access the API.Answer
  4. D
    Configure an Amazon Cognito Identity Pool federated with the SAML IdP. Define an IAM role with a trust policy allowing public access, associate it with the API Gateway resource, and extract the SAML assertion directly from the API gateway context mapping.

Answer

Configure an Amazon Cognito User Pool federated with the SAML IdP. Create a Cognito User Pool Authorizer in API Gateway and pass the Cognito ID token in the request header to access the API.
Using Amazon Cognito User Pools federated with a SAML Identity Provider allows user directory and authentication federation. API Gateway's built-in Cognito User Pool Authorizer handles token validation natively, passing claims directly to the integration backend (Lambda) in the request context under authorizer claims. This eliminates the need for writing custom token validation code or signing API requests with AWS Signature Version 4.

Step-by-Step Solution

1
Select the correct Cognito service type for user authentication and federation.
Amazon Cognito User Pools is selected because it acts as a user directory and natively federates with SAML Identity Providers.
Cognito User Pools authenticate users and generate standard JSON Web Tokens (JWTs) containing identity claims.
2
Integrate the token validation at the API Gateway layer.
Create a built-in Cognito User Pool Authorizer on the API Gateway REST API.
This authorizer natively decodes and validates Cognito tokens sent in the Authorization header without requiring custom authorizer code.
3
Access user profile claims in the backend AWS Lambda function.
The Lambda function receives the verified user claims in the request event context under the authorizer claims object.
API Gateway automatically forwards claims from the validated Cognito token to the integration backend, allowing claims-based authorization.

Key Concept

Built-in integration between API Gateway and Cognito User Pools for user authentication and claims propagation.
Estimated Time:1m 30s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic