Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

An enterprise web application needs to allow employees to sign in using their corporate Identity Provider (IdP) via SAML 2.0. Once authenticated, the application must allow users to upload files directly to a user-specific folder in an Amazon S3 bucket. The architecture must minimize operational overhead and avoid storing long-term credentials on the client. Which solution meets these requirements with the least operational overhead?

  1. A
    Configure an Amazon Cognito User Pool integrated with the SAML IdP. Retrieve the ID token upon successful authentication and pass it directly to the Amazon S3 API headers to authorize direct client-side uploads.
  2. B
    Configure an Amazon API Gateway endpoint with a custom Lambda Authorizer that validates the SAML assertions, creates a Cognito User Pool user on the fly, and uses the API Gateway service integration to upload files directly to S3.
  3. Configure an Amazon Cognito User Pool integrated with the SAML IdP, and associate it with an Amazon Cognito Identity Pool. Use the Identity Pool to map the federated users to an IAM role that grants access to the user-specific S3 folder using the cognito-identity.amazonaws.com:sub variable.Answer
  4. D
    Configure an Amazon Cognito User Pool integrated with the SAML IdP. Set up an API Gateway endpoint backed by a Lambda function that contains hardcoded IAM access keys to upload files to the S3 bucket on behalf of the user.

Answer

Configure an Amazon Cognito User Pool integrated with the SAML IdP, and associate it with an Amazon Cognito Identity Pool. Use the Identity Pool to map the federated users to an IAM role that grants access to the user-specific S3 folder using the cognito-identity.amazonaws.com:sub variable.
The correct solution leverages Amazon Cognito User Pools to manage authentication with the corporate SAML Identity Provider, and Amazon Cognito Identity Pools to exchange the authentication tokens for temporary AWS IAM credentials. The IAM policy attached to the authenticated role uses the cognito-identity.amazonaws.com:sub policy variable to dynamically restrict access to the user's specific folder in the S3 bucket, ensuring security with minimal operational overhead.

Step-by-Step Solution

1
Configure SAML federation with the corporate Identity Provider within an Amazon Cognito User Pool.
Users can authenticate against their corporate IdP and receive Cognito User Pool tokens.
This establishes user authentication without managing passwords locally or creating custom SAML validation logic.
2
Link the Cognito User Pool as an authentication provider in an Amazon Cognito Identity Pool.
The Identity Pool can verify the Cognito User Pool tokens and exchange them for temporary AWS credentials.
Cognito Identity Pools are designed to authorize users and provide temporary AWS IAM credentials.
3
Create an IAM role for authenticated users with a policy permitting S3 PutObject actions restricted to user-specific prefixes using the cognito-identity.amazonaws.com:sub variable, and associate it with the Identity Pool.
Authenticated users receive dynamic, scope-limited temporary credentials to upload directly to their own S3 folder.
This implements secure, direct client-to-S3 uploads with minimal latency, avoiding the need for an intermediary backend server or hardcoded credentials.

Key Concept

Amazon Cognito Identity Pools are used to federate identities and obtain temporary AWS credentials for accessing AWS resources like Amazon S3, whereas Cognito User Pools handle user directory management and authentication.
Estimated Time:2m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic