Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A developer is configuring authentication and authorization for a serverless web application. The application consists of a Single-Page Application (SPA) frontend and a REST API hosted on Amazon API Gateway. The developer wants to use Amazon Cognito to authenticate users directly through a sign-up and sign-in flow. Additionally, authenticated users in the "PremiumUsers" Cognito group must be allowed to directly download private reports from an Amazon S3 bucket, while standard authenticated users should only access the API. Which two configuration steps should the developer perform to meet these requirements? (Select TWO.)

  1. Configure an Amazon Cognito User Pool to authenticate users and secure the API Gateway REST API using a Cognito Authorizer.Answer
  2. Configure an Amazon Cognito Identity Pool to federate the User Pool tokens and map the 'PremiumUsers' group to an IAM role with S3 read permissions.Answer
  3. C
    Create a custom API Gateway Lambda Authorizer to validate the Amazon Cognito JSON Web Tokens (JWT) and manage user pool group verification.
  4. D
    Use the Amazon Cognito User Pool to directly exchange the user's password for temporary AWS credentials to access S3.
  5. E
    Attach an IAM policy directly to the Amazon Cognito User Pool that trusts the S3 bucket to allow direct data transfer.

Answer

The developer should configure an Amazon Cognito User Pool to authenticate users and secure the API Gateway using a Cognito Authorizer, and configure an Amazon Cognito Identity Pool to federate User Pool tokens and map the 'PremiumUsers' group to an IAM role with S3 read permissions.
To authenticate users and secure the REST API, a Cognito User Pool is configured along with a native API Gateway Cognito Authorizer. To authorize users to directly access S3 resources, a Cognito Identity Pool is set up to federate the User Pool tokens, allowing the application to map specific user groups (like 'PremiumUsers') to IAM roles with permission to retrieve objects from the S3 bucket.

Step-by-Step Solution

1
Configure a User Pool for user authentication.
Users can sign up, sign in, and obtain JSON Web Tokens (JWTs) representing their identity and group memberships.
Cognito User Pools serve as the identity directory for client application authentication.
2
Integrate the User Pool with API Gateway.
The API Gateway REST API is secured, permitting only requests with valid User Pool tokens.
A Cognito Authorizer automatically validates incoming ID or Access tokens from the User Pool.
3
Establish an Identity Pool linked to the User Pool and configure IAM role mapping.
Authenticated users receive temporary AWS credentials, with the 'PremiumUsers' group mapped to an IAM role granting S3 read access.
Cognito Identity Pools authorize users to access AWS resources directly by mapping their authenticated identity to specific IAM roles.

Key Concept

Amazon Cognito User Pools handle authentication (user directory, JWTs), while Identity Pools handle authorization (temporary AWS credentials via IAM roles). API Gateway can use a built-in Cognito Authorizer for User Pools.
Estimated Time:1m 30s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic