Examkin

Question

Difficulty: HardIAM Policies and Roles

A developer is implementing a mobile application that uses an Amazon Cognito identity pool to grant users temporary AWS credentials for uploading files to an Amazon S3 bucket. The developer has created an IAM role for authenticated users, but when the mobile application attempts to exchange the Cognito identity token for temporary credentials, the request fails with an access denied error. The developer reviews the trust policy currently attached to the IAM role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "cognito-identity.amazonaws.com"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"cognito-identity.amazonaws.com:aud": "us-east-1:12345678-1234-1234-1234-1234567890ab"
},
"ForAnyValue:StringLike": {
"cognito-identity.amazonaws.com:amr": "authenticated"
}
}
}
]
}

Which modification to the trust policy will resolve this issue?

  1. A
    Change the Action to sts:AssumeRoleWithWebIdentity, but leave the Principal as a Service principal.
  2. B
    Change the Principal key to Federated with the value set to cognito-identity.amazonaws.com, but leave the Action as sts:AssumeRole.
  3. Change the Principal key to Federated and set its value to cognito-identity.amazonaws.com, and change the Action to sts:AssumeRoleWithWebIdentity.Answer
  4. D
    Remove the trust policy from the role and configure the mobile application SDK with the hardcoded Access Key ID and Secret Access Key of a dedicated IAM user.

Answer

Change the Principal key to Federated and set its value to cognito-identity.amazonaws.com, and change the Action to sts:AssumeRoleWithWebIdentity.
The correct option correctly adjusts both the Principal to Federated and the Action to sts:AssumeRoleWithWebIdentity. Amazon Cognito Identity Pools act as a web identity federation provider. Therefore, any IAM role intended for authentication via Cognito must allow the federated identity 'cognito-identity.amazonaws.com' as the Principal, and it must permit the 'sts:AssumeRoleWithWebIdentity' API action to facilitate exchanging the Cognito token for temporary AWS credentials.

Step-by-Step Solution

1
Identify the authentication source in the scenario.
Amazon Cognito Identity Pools acts as an external federated OpenID Connect (OIDC) provider, not a native internal AWS service.
Understanding the source dictates which Principal type and STS action are required in the trust policy.
2
Correct the Principal definition in the trust policy.
Change 'Service' to 'Federated' with the value 'cognito-identity.amazonaws.com'.
Federated identity providers require the Federated key rather than the Service key in IAM trust policy statements.
3
Correct the permitted Action in the trust policy.
Change the Action from 'sts:AssumeRole' to 'sts:AssumeRoleWithWebIdentity'.
Exchanging OIDC or web identity federation tokens for temporary AWS credentials requires authorization for the AssumeRoleWithWebIdentity API call.

Key Concept

IAM Trust Policies for Web Identity Federation
Rate this question

Topics

IAM Policies and Roles

More questions from this topic